CVE-2026-129428

A Pulse viewer could decide another user’s AI approval request

Pulse maintainers · Pulse AI Assistant approvals

First documented disclosure · Review checkpoint

Summary

The approval API checked organization membership without enforcing permission to make an approval decision. The viewer could see proposed commands and targets, approve or deny requests, and change the audit record.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The maintainer published a controlled demonstration. Its advisory does not identify a malicious decision in a deployed organization.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The approval API checked organization membership without enforcing permission to make an approval decision.

Conditions required

A signed-in viewer belonged to the same organization as a pending request.

Potential impact

The viewer could see proposed commands and targets, approve or deny requests, and change the audit record.

Affected versions and configurations

The maintainer lists 5.0.17 through builds before 6.8.0-rc.2. The CNA groups affected stable releases as 5.0.17 through versions before 6.8.0.

Fix and mitigation status

6.8.0 is the named stable fix.

Practical next steps

Upgrade to 6.8.0 or later. Until then, reserve viewer access for people authorized to see and decide requests.

Operating lesson

Check approval authority on every decision, including denials.

Evidence and limits

The CVE record was published on 2026-11-14.

Sources