CVE-2026-76304: The software does not perform an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk SOAR

In Splunk SOAR versions below 8.7.0, an authorization bypass vulnerability allows authenticated users lacking the Automation Broker edit role permission to access and download the Automation Broker Docker Compose configuration file. This occurs because Splunk SOAR does not perform an authorization check before returning the configuration file, exposing internal URLs and version information related to the Automation Broker deployment.

The vulnerability exposes configuration details including the Splunk SOAR instance URL, container image location, and Automation Broker version to unauthorized authenticated users. While it does not allow modification or denial of service, the information disclosure could aid attackers in reconnaissance or further attacks.

Upgrade Splunk SOAR to version 8.7.0 or later where this authorization check issue is fixed. Until then, restrict access to authenticated users with appropriate Automation Broker edit permissions. Review and enforce role-based access controls to limit exposure.