---
id: "CVE-2026-76305"
kind: "vulnerability"
aliases: ["CVE-2026-76305"]
title: "Splunk SOAR: users without app-view role can download app archives"
severity: "medium"
cvss: 6.5
epss: 0.00274
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "self-hosted", "soar-apps", "splunk-soar"]
not_affected_if: ["no-untrusted-accounts", "version-8.7.0-or-later"]
published_at: "2026-10-21T23:17:28+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:48:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76305", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-76305", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Splunk SOAR: users without app-view role can download app archives

In Splunk SOAR below 8.7.0, a logged-in user without permission to view apps can download an archive of an installed app. The archive can expose proprietary source code and sensitive data stored in the app.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Splunk SOAR version with the product's admin UI or package metadata; versions below `8.7.0` are in scope
- Review which accounts and roles exist in Splunk SOAR and which hold the permission to view apps

## Fix

- Upgrade Splunk SOAR to `8.7.0` or later
- Until upgraded, limit user accounts to trusted staff

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76305
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-76305

## From the sources

In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive of an installed app. This could expose all data in the app archive, including proprietary source code and sensitive information.
The vulnerability is possible because Splunk SOAR does not verify permission to view apps before it returns the app archive.
For more information see Export or import an app (https://help.splunk.com/en/splunk-soar/soar-on-premises/develop-apps/8.4.0/develop-an-app-using-the-splunk-soar-app-wizard/export-or-import-an-app) and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_