A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. Affected by this issue is the function fmt.Sprintf of the file /api/security/quick-setup of the component Quick Security Setup Handler. The manipulation of the argument Username results in improper input validation.
The attack may be performed from remote. Upgrading the affected component is advised.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
High
Admin privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
References 7
https://github.com/rcourtman/Pulse/
cna@vuldb.com
https://github.com/rcourtman/Pulse/releases/tag/v6.1.0
cna@vuldb.com
https://github.com/rcourtman/Pulse/security/advisories/GHSA-rr3f-jjrr-3qxv
cna@vuldb.com
https://vuldb.com/cve/CVE-2026-92860
cna@vuldb.com
https://vuldb.com/submit/941807
cna@vuldb.com
https://vuldb.com/vuln/406309
cna@vuldb.com
https://vuldb.com/vuln/406309/cti
cna@vuldb.com