CVE-2026-76303: The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. in Splunk Splunk SOAR

In Splunk SOAR versions below 8.7.0, a stored cross-site scripting (XSS) vulnerability exists due to improper neutralization of user-controllable input in app documentation content. A user with the install_apps capability can inject attacker-controlled content into app documentation by installing an app. When another user with permission to view apps accesses this documentation, the malicious content executes in their browser context. This enables the attacker to perform actions and access data with the victim user's privileges. The vulnerability requires social engineering to induce the victim to load the malicious content.

Successful exploitation allows an attacker with install_apps capability to execute arbitrary scripts in the browser of users who view the compromised app documentation. This can lead to unauthorized data access and modification with the victim user's permissions. The vulnerability does not allow the attacker to exploit it directly without tricking the victim user. There is no indication of impact to system availability.

A fix is available in Splunk SOAR version 8.7.0 and later. Users should upgrade to version 8.7.0 or newer to remediate this vulnerability. Until upgraded, restrict the install_apps capability to trusted users only and educate users about phishing risks to reduce the likelihood of exploitation.