CVE-2025-22621: Privilege escalation for users who hold the “splunk_app_soar“ role in the Splunk App for SOAR
In versions 1.0.67 and lower of the Splunk App for SOAR, the Splunk documentation for that app recommended adding the adminallobjects capability to the splunkappsoar role. This addition could lead to improper access control for a low-privileged user that does not hold the "admin" Splunk roles.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22621?
CVE-2025-22621 is considered a moderate severity vulnerability due to its potential for improper access control.
How do I fix CVE-2025-22621?
To fix CVE-2025-22621, remove the `admin_all_objects` capability from the `splunk_app_soar` role in versions 1.0.67 and lower.
What versions of Splunk App for SOAR are affected by CVE-2025-22621?
CVE-2025-22621 affects all versions of Splunk App for SOAR up to and including 1.0.67.
What does the `admin_all_objects` capability do in Splunk App for SOAR?
The `admin_all_objects` capability grants extensive permissions that could lead to security risks if assigned to low-privileged users.
Is there a workaround for CVE-2025-22621 if I cannot update right away?
A temporary workaround for CVE-2025-22621 is to restrict the `splunk_app_soar` role by not assigning the `admin_all_objects` capability while planning to update.