Missing authorization in Splunk SOAR lets users download app archives
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
Splunk SOAR versions from 0 before 8.7.0 do not check app view permissions before returning an app archive. An authenticated user without a role that allows viewing apps can download an archive of an installed app, which can expose proprietary source code and sensitive information. The flaw is a missing authorization check (CWE-862).
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive of an installed app. This could expose all data in the app archive, including proprietary source code and sensitive information. The vulnerability is possible because Splunk SOAR does not verify permission to view apps before it returns the app archive. For more information see Export or import an app (https://help.splunk.com/en/splunk-soar/soar-on-premises/develop-apps/8.4.0/develop-an-app-using-the-splunk-soar-app-wizard/export-or-import-an-app) and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Upgrade Splunk SOAR to version 8.7.0 or later, which fixes the issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA Splunk SOAR (Splunk) Fixed in 8.7.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Splunk SOAR 8.7.0
15 records Highest priority Priority MEDIUM 8 MEDIUM, 7 LOW
Other records, highest priority first
- TI-2026-79051 Improper protection of alternate path in Splunk SOARPriority MEDIUM 49
- TI-2026-79050 Protection mechanism failure in Splunk SOARPriority MEDIUM 49
- TI-2026-79049 Improper exception handling in Splunk SOARPriority MEDIUM 49
Timeline
- 2026-10-21 Threatist record created from CVE-2026-76305
- 2026-10-22 Alias added: GHSA-6p7q-8j84-xg97
- 2026-10-23 Priority changed: MEDIUM → LOW
- 2026-10-28 CISA SSVC decision points changed
References
More Splunk vulnerabilities
- TI-2026-16444 Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise KEVCVSS 3.1CRITICAL 9.8
- TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
- TI-2023-24841 Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing CVSS 3.1HIGH 8.8
- TI-2023-12257 Injection in https://github.com/curl/curl CVSS 3.1CRITICAL 9.8
- TI-2022-13930 Information disclosure in https://github.com/curl/curl CVSS 3.1CRITICAL 9.8
- TI-2022-13917 Incorrect default permissions in https://github.com/curl/curl CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-76305 · CVE Program
- CVE-2026-76305 · NVD
- FIRST EPSS
- GHSA-6p7q-8j84-xg97 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences