CVE-2026-76368: Missing Authorization through Playbooks in Splunk SOAR
In Splunk SOAR versions below 8.6.0, a user who holds a role that contains the playbooks:view permission could view metadata about a playbook repository that they are not authorized to view. The vulnerability is possible because Playbook History does not check repository permissions before returning playbook revision metadata. For more information see Manage roles and permissions in Splunk SOAR (Cloud) (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) and Manage settings for a playbook in Splunk SOAR (Cloud) (https://help.splunk.com/en/splunk-soar/soar-cloud/build-playbooks/manage-playbooks-and-playbook-settings/manage-settings-for-a-playbook-in-splunk-soar-cloud) in the Splunk documentation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.6.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Splunk SOAR deployments running versions below 8.6.0 are affected if a user has a role containing the playbooks:view permission. The issue can expose metadata for playbook repositories that the user is not otherwise authorized to view.
What access does an attacker need?
An attacker must already be authenticated as a Splunk SOAR user and hold a role with the playbooks:view permission. No user interaction is required.
What information can be exposed?
The issue exposes playbook revision metadata returned through Playbook History. The provided information does not indicate that playbook contents can be modified or that availability is affected.