CVE-2026-76305Medium· 6.5▾ SunlitIn Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive of an installed app. This could expose all data in the app archive, including proprietary source c…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive of an installed app. This could expose all data in the app archive, including proprietary source code and sensitive information. The vulnerability is possible because Splunk SOAR does not verify permission to view apps before it returns the app archive. For more information see Export or import an app (https://help.splunk.com/en/splunk-soar/soar-on-premises/develop-apps/8.4.0/develop-an-app-using-the-splunk-soar-app-wizard/export-or-import-an-app) and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.
soar < 8.7.0Upgrade Splunk SOAR to version 8.7.0 or higher.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-76304Medium· 4.3Sensitive Information Disclosure through Automation Broker Configuration in Splunk SOAR
CVE-2026-76308Medium· 6.5Missing Authorization through the REST API in Splunk SOAR
CVE-2026-76303Medium· 5.7Stored Cross-Site Scripting (XSS) through App Documentation in Splunk SOAR
CVE-2026-76306High· 7.5Information Disclosure through REST API Query Filters in Splunk SOAR
CVE-2026-76406Medium· 5.9Information Disclosure through REST API Authentication in Splunk SOAR
CVE-2026-76307High· 7.2Sensitive Information Disclosure through REST API Query Filters in Splunk SOAR