{"id":"CVE-2026-76305","kind":"vulnerability","aliases":["CVE-2026-76305"],"related":[],"title":"Splunk SOAR: users without app-view role can download app archives","description":"In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive of an installed app. This could expose all data in the app archive, including proprietary source code and sensitive information.\nThe vulnerability is possible because Splunk SOAR does not verify permission to view apps before it returns the app archive.\nFor more information see Export or import an app (https://help.splunk.com/en/splunk-soar/soar-on-premises/develop-apps/8.4.0/develop-an-app-using-the-splunk-soar-app-wizard/export-or-import-an-app) and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.","summary":"In Splunk SOAR below 8.7.0, a logged-in user without permission to view apps can download an archive of an installed app. The archive can expose proprietary source code and sensitive data stored in the app.","severity":"medium","cvss":6.5,"epss":0.00274,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","self-hosted","soar-apps","splunk-soar"],"not_affected_if":["no-untrusted-accounts","version-8.7.0-or-later"],"how_to_check":"- Check the installed Splunk SOAR version with the product's admin UI or package metadata; versions below `8.7.0` are in scope\n- Review which accounts and roles exist in Splunk SOAR and which hold the permission to view apps","fix":"- Upgrade Splunk SOAR to `8.7.0` or later\n- Until upgraded, limit user accounts to trusted staff","status":"open","published_at":"2026-10-21T23:17:28+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:48:46+00:00","updated_at":"2026-10-25T03:48:46+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T03:48:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Splunk SOAR to `8.7.0` or later\n- Until upgraded, limit user accounts to trusted staff","reach":"network","title":"Splunk SOAR: users without app-view role can download app archives","impact":"medium","summary":"In Splunk SOAR below 8.7.0, a logged-in user without permission to view apps can download an archive of an installed app. The archive can expose proprietary source code and sensitive data stored in the app.","category":"other","nicknames":[],"who_cares":["splunk-soar","self-hosted","soar-apps"],"confidence":0.7,"needs_auth":"yes","worst_case":"proprietary app source code and sensitive app data exposed","analyst_note":"","how_to_check":"- Check the installed Splunk SOAR version with the product's admin UI or package metadata; versions below `8.7.0` are in scope\n- Review which accounts and roles exist in Splunk SOAR and which hold the permission to view apps","needs_analyst":false,"not_affected_if":["version-8.7.0-or-later","no-untrusted-accounts"],"who_is_affected":"Splunk SOAR on-premises deployments below 8.7.0 that have user accounts without the app-view role. The attacker must already hold a valid account on the SOAR instance. Deployments on 8.7.0 or later are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000609,"input_tokens":3590,"output_tokens":499,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-76305':15A,18A '/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises)':155C '/en/splunk-soar/soar-on-premises/develop-apps/8.4.0/develop-an-app-using-the-splunk-soar-app-wizard/export-or-import-an-app)':141C '8.7.0':33B,71C 'app':6A,11A,25B,43B,51B,65B,85C,93C,101C,123C,128C,138C 'app-view':5A 'archiv':12A,47B,53B,89C,102C,129C 'authent':73C 'code':58B,106C 'could':86C,95C 'cve':13A,16A 'data':61B,98C 'document':159C 'download':10A,45B,87C 'export':134C 'expos':55B,96C 'help.splunk.com':140C,154C 'help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises)':153C 'help.splunk.com/en/splunk-soar/soar-on-premises/develop-apps/8.4.0/develop-an-app-using-the-splunk-soar-app-wizard/export-or-import-an-app)':139C 'hold':78C 'host':22B 'import':136C 'includ':103C 'inform':109C,132C 'instal':50B,92C 'log':36B 'logged-in':35B 'manag':143C 'on-premis':150C 'permiss':40B,82C,120C,146C 'possibl':113C 'premis':152C 'proprietari':56B,104C 'return':126C 'role':8A,80C,144C 'see':133C 'self':21B 'self-host':20B 'sensit':60B,108C 'soar':2A,24B,28B,31B,68C,116C,149C 'soar-app':23B 'sourc':57B,105C 'splunk':1A,27B,30B,67C,115C,148C,158C 'splunk-soar':26B 'store':62B 'user':3A,38B,74C 'verifi':119C 'version':69C 'view':7A,42B,84C,122C 'vulner':111C 'without':4A,39B","nicknames":[],"mitigations":[],"who_affected":"Splunk SOAR on-premises deployments below 8.7.0 that have user accounts without the app-view role. The attacker must already hold a valid account on the SOAR instance. Deployments on 8.7.0 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T23:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76305","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76305","severity":null,"published_at":"2026-10-21T23:17:28+00:00","modified_at":"2026-10-22T16:57:10+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-76305","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76305","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}