rcourtman Pulse CVE-2026-92860

Exploitation targets the Quick Security Setup Handler at /api/security/quick-setup, specifically the Username argument processed via fmt.Sprintf. The vendor CVSS vector states PR:H (high privileges required), which would limit exploitation to an already-privileged/admin context; however, 'quick security setup' endpoints are commonly reachable during initial, unconfigured deployment before authentication exists, which would instead imply no prior authentication - this contradiction is unresolved in the available data and must be confirmed against advisory GHSA-rr3f-jjrr-3qxv. Practical limiting factors: the flaw is confined to Pulse instances exposing this API, versions up to 6.0.4 / 6.1.0-rc.4, and the demonstrated impact is unclear (tagged information disclosure), reducing realistic risk below the 9.4 headline.

Conflicting signals dominate this record. The input carries a CVSS 4.0 score of 9.4 (VC/VI/VA:H and SC/SI/SA:H, full impact plus scope change) yet the vector sets PR:H, and the CWE is only CWE-20 (improper input validation) with a real-world tag of 'Information Disclosure' - the vendor's own metadata is internally inconsistent, since a mere input-validation flaw driving full compromise of both the vulnerable and a subsequent system is rarely justified. This is a VulDB-sourced entry (cna@vuldb.com, submission 941807, vuln 406309), and VulDB auto-generated scores for small open-source projects are frequently inflated relative to demonstrated impact. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The description is boilerplate ('manipulation of the argument Username results in improper input validation') and does not substantiate the H/H/H impact claimed. Net: treat this as a moderate-priority patch item for Pulse operators, NOT a 9.4 emergency - the headline score is unverified and likely overstated. Also note tension in the attack vector: a 'Quick Security Setup' handler is typically reachable during initial/unconfigured setup (implying no prior auth), which conflicts with the PR:H in the vector - verify actual authentication requirements against the GHSA-rr3f-jjrr-3qxv advisory before relying on either reading.

An attacker with access to Pulse's /api/security/quick-setup endpoint submits a crafted Username value that the Quick Security Setup Handler passes into fmt.Sprintf without validation, triggering the CWE-20 flaw (potentially a Go format-string or injection-style misuse of the username). No public proof-of-concept is available, and the precise impact (the tag suggests information disclosure) is not demonstrated in the provided data.