{"id":"CVE-2026-76307","kind":"vulnerability","aliases":["CVE-2026-76307"],"related":[],"title":"Splunk SOAR: REST API filters let low-privilege users infer admin tokens","description":"In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer (REST) API to infer authentication token values for other users. If the inferred token grants administrative access, that user could gain administrative access to the Splunk SOAR instance.\nThe vulnerability is possible because the REST API accepts caller-controlled query filters on sensitive user record fields.\nFor more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Query for Data (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/query-for-data), and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/6.4.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.","summary":"In Splunk SOAR versions below 8.7.0, a user with the Users and Roles view permission can use the REST API to infer authentication token values of other users. If the inferred token has administrative rights, the attacker gains administrative access to the SOAR instance.","severity":"high","cvss":7.2,"epss":0.00317,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","security-operations","self-hosted","splunk-soar"],"not_affected_if":["no-users-and-roles-view-role","version-8.7.0-or-later"],"how_to_check":"- Check the installed Splunk SOAR version in the product's admin UI or on the host, and compare it to `8.7.0`.\n- Review which accounts hold a role with the Users and Roles view permission, per the Splunk role and permissions documentation.","fix":"- Upgrade Splunk SOAR (On-premises) to `8.7.0` or later.\n- Until upgraded, restrict the Users and Roles view permission to trusted accounts only.","status":"open","published_at":"2026-10-21T23:17:28+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:29:00+00:00","updated_at":"2026-10-25T03:29:00+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-25T03:29:00Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Splunk SOAR (On-premises) to `8.7.0` or later.\n- Until upgraded, restrict the Users and Roles view permission to trusted accounts only.","reach":"network","title":"Splunk SOAR: REST API filters let low-privilege users infer admin tokens","impact":"high","summary":"In Splunk SOAR versions below 8.7.0, a user with the Users and Roles view permission can use the REST API to infer authentication token values of other users. If the inferred token has administrative rights, the attacker gains administrative access to the SOAR instance.","category":"other","nicknames":[],"who_cares":["splunk-soar","self-hosted","security-operations"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker becomes SOAR administrator by inferring another user's token","analyst_note":"","how_to_check":"- Check the installed Splunk SOAR version in the product's admin UI or on the host, and compare it to `8.7.0`.\n- Review which accounts hold a role with the Users and Roles view permission, per the Splunk role and permissions documentation.","needs_analyst":false,"not_affected_if":["version-8.7.0-or-later","no-users-and-roles-view-role"],"who_is_affected":"Splunk SOAR (On-premises) instances below 8.7.0 where some users hold a role with the Users and Roles view permission. Instances already on 8.7.0 or later are not affected, and instances where only fully trusted administrators can view users have much less exposure.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00065,"input_tokens":3709,"output_tokens":558,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-76307':16A,19A '/en/splunk-soar/soar-on-premises/administer-soar-on-premises/6.4.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises)':183C '/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/query-for-data),':169C '/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises),':163C '8.7.0':35B,79C 'accept':135C 'access':69B,115C,121C 'admin':12A 'administr':63B,68B,114C,120C 'api':4A,49B,100C,134C,153C 'attack':66B 'authent':52B,103C 'caller':137C 'caller-control':136C 'control':138C 'could':93C,118C 'cve':14A,17A 'data':166C 'document':187C 'field':145C 'filter':5A,140C 'gain':67B,119C 'grant':113C 'help.splunk.com':162C,168C,182C 'help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/6.4.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises)':181C 'help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/query-for-data),':167C 'help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises),':161C 'hold':83C 'host':26B 'infer':11A,51B,60B,102C,111C 'inform':148C 'instanc':73B,126C 'let':6A 'low':8A 'low-privileg':7A 'manag':171C 'on-premis':158C,178C 'oper':23B 'permiss':44B,92C,174C 'possibl':130C 'premis':160C,180C 'privileg':9A 'queri':139C,164C 'record':144C 'refer':154C 'represent':96C 'rest':3A,48B,99C,133C,152C 'right':64B 'role':42B,85C,90C,172C 'secur':22B 'security-oper':21B 'see':149C 'self':25B 'self-host':24B 'sensit':142C 'soar':2A,29B,32B,72B,76C,125C,157C,177C 'splunk':1A,28B,31B,75C,124C,156C,176C,186C 'splunk-soar':27B 'state':97C 'token':13A,53B,61B,104C,112C 'transfer':98C 'use':46B,94C,150C 'user':10A,37B,40B,57B,81C,88C,108C,117C,143C 'valu':54B,105C 'version':33B,77C 'view':43B,91C 'vulner':128C","nicknames":[],"mitigations":[],"who_affected":"Splunk SOAR (On-premises) instances below 8.7.0 where some users hold a role with the Users and Roles view permission. Instances already on 8.7.0 or later are not affected, and instances where only fully trusted administrators can view users have much less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T23:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76307","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76307","severity":null,"published_at":"2026-10-21T23:17:28+00:00","modified_at":"2026-10-23T15:17:34+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-76307","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76307","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}