---
id: CVE-2026-76308
title: Missing Authorization through the REST API in Splunk SOAR
summary: >-
  In Splunk SOAR versions below 8.7.0, an authenticated user could change the
  Enterprise Security edition through the Representational State Transfer (REST)
  API and cause Splunk SOAR to apply the license change.

  The vulnerability is possib…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: Splunk
product: Splunk SOAR
affected:
  - soar < 8.7.0
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T22:52:11.575Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-76308'
references:
  - url: 'https://advisory.splunk.com/advisories/SVD-2026-1010'
tags:
  - cve.org
ingestedAt: '2026-10-21T23:20:10.322Z'
---

## Overview

In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition through the Representational State Transfer (REST) API and cause Splunk SOAR to apply the license change.
The vulnerability is possible because Splunk SOAR authenticates requests to manage the Enterprise Security edition but does not authorize the caller before it applies the license change.
For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.7.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Obtain and configure a Splunk SOAR (On-premises) license (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.7.0/configure-your-companys-settings-in-splunk-soar-on-premises/obtain-and-configure-a-splunk-soar-on-premises-license), and Integration of Splunk SOAR with Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.7/automation-with-playbooks/integration-of-splunk-soar-with-splunk-enterprise-security) in the Splunk documentation.

## Affected

- `soar < 8.7.0`

## Remediation

Upgrade Splunk SOAR to version 8.7.0 or higher.