CVE-2026-76305: Improper Access Control during App Downloads in Splunk SOAR
In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive of an installed app. This could expose all data in the app archive, including proprietary source code and sensitive information. The vulnerability is possible because Splunk SOAR does not verify permission to view apps before it returns the app archive. For more information see Export or import an app (https://help.splunk.com/en/splunk-soar/soar-on-premises/develop-apps/8.4.0/develop-an-app-using-the-splunk-soar-app-wizard/export-or-import-an-app) and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Splunk SOARto a version that resolves this vulnerability.Fixed in 8.7.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Splunk SOAR user who lacks a role permission to view apps can exploit it. No user interaction is required.
What information could be exposed?
The user could download an archive of an installed app. The archive may contain all app data, including proprietary source code and sensitive information.
Which deployments are affected?
Splunk SOAR versions below 8.7.0 are affected. Deployments where authenticated users can access the relevant download functionality are exposed even when those users are not permitted to view apps.
What should be done to remediate the issue?
Upgrade Splunk SOAR to version 8.7.0 or later. The affected behavior is the failure to verify app-view permission before returning an app archive.