Threats tagged 'ghsa-c2gc-chxg-hvqr'

Pulse versions from 5.0.17 up to but not including 6.8.0 contain a missing authorization vulnerability in the /api/ai/approvals endpoints. This flaw allows authenticated users with viewer-level privileges to manage approval requests improperly. Attackers can list pending approval requests, exposing proposed commands and targets, and can approve or deny requests from other users, affecting decision and audit states.