Missing Authorization in Splunk Security Orchestration, Automation and Response (SOAR) - CVE-2026-76305
Published: October 22, 2026
Vulnerability identifier: #VU157060
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76305
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose installed app archive contents, including proprietary source code and sensitive information.
The vulnerability exists due to missing authorization in Splunk SOAR's app download functionality when returning installed app archives. A remote user can request an app archive without permission to view apps to obtain all data contained in the archive.
Affected software
Splunk Security Orchestration, Automation and Response (SOAR)
How to mitigate CVE-2026-76305
Install security update from vendor's website.
Splunk Security Orchestration, Automation and Response (SOAR) - update to 8.7.0