---
id: "CVE-2026-76307"
kind: "vulnerability"
aliases: ["CVE-2026-76307"]
title: "Splunk SOAR: REST API filters let low-privilege users infer admin tokens"
severity: "high"
cvss: 7.2
epss: 0.00317
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "security-operations", "self-hosted", "splunk-soar"]
not_affected_if: ["no-users-and-roles-view-role", "version-8.7.0-or-later"]
published_at: "2026-10-21T23:17:28+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:29:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76307", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-76307", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Splunk SOAR: REST API filters let low-privilege users infer admin tokens

In Splunk SOAR versions below 8.7.0, a user with the Users and Roles view permission can use the REST API to infer authentication token values of other users. If the inferred token has administrative rights, the attacker gains administrative access to the SOAR instance.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Splunk SOAR version in the product's admin UI or on the host, and compare it to `8.7.0`.
- Review which accounts hold a role with the Users and Roles view permission, per the Splunk role and permissions documentation.

## Fix

- Upgrade Splunk SOAR (On-premises) to `8.7.0` or later.
- Until upgraded, restrict the Users and Roles view permission to trusted accounts only.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76307
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-76307

## From the sources

In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer (REST) API to infer authentication token values for other users. If the inferred token grants administrative access, that user could gain administrative access to the Splunk SOAR instance.
The vulnerability is possible because the REST API accepts caller-controlled query filters on sensitive user record fields.
For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Query for Data (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/query-for-data), and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/6.4.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_