CVE-2026-76386: Information Disclosure through Action Parameters in Zoom app for Splunk SOAR
In versions below 3.2.2 of the Zoom app for Splunk SOAR, a user who holds a role with permission to run actions could expose meeting and personal meeting ID passwords by invoking one of the create meeting, update meeting, or update user settings actions, because the affected password and pmipassword parameters are not masked and are shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameters as passwords. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zoom app for Splunk SOARto a version that resolves this vulnerability.Fixed in 3.2.2
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with a Splunk SOAR role that permits running actions can expose the affected values. The issue applies when that user invokes the create meeting, update meeting, or update user settings actions in the Zoom app.
What information can be disclosed?
Meeting passwords and personal meeting ID passwords can be displayed in cleartext. The affected action parameters are password and pmi_password.
Are default action settings affected?
The issue is caused by the affected parameters not being marked as passwords, so Splunk SOAR does not mask them in the user interface when the relevant actions are run.
What version resolves the issue?
Versions below 3.2.2 are affected. Upgrading the Zoom app for Splunk SOAR to version 3.2.2 or later addresses the disclosed version range.