Live › vulnerability › CVE-2026-76305
Go to dashboardIn Splunk SOAR below 8.7.0, a logged-in user without permission to view apps can download an archive of an installed app. The archive can expose proprietary source code and sensitive data stored in the app.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Splunk SOAR on-premises deployments below 8.7.0 that have user accounts without the app-view role. The attacker must already hold a valid account on the SOAR instance. Deployments on 8.7.0 or later are not affected.
No product ranges from the sources yet.
8.7.0 are in scope8.7.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive of an installed app. This could expose all data in the app archive, including proprietary source code and sensitive information. The vulnerability is possible because Splunk SOAR does not verify permission to view apps before it returns the app archive. For more information see Export or import an app (https://help.splunk.com/en/splunk-soar/soar-on-premises/develop-apps/8.4.0/develop-an-app-using-the-splunk-soar-app-wizard/export-or-import-an-app) and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.
This page as .md · .json · in your agent: get_signal("CVE-2026-76305")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.