CVE-2026-76305: The software does not perform an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk SOAR

In Splunk SOAR versions below 8.7.0, the application fails to verify whether an authenticated user has the permission to view apps before allowing the download of an installed app's archive. This lack of authorization checking enables users with limited roles to access app archives they should not be able to view, exposing sensitive data including proprietary source code. The vulnerability arises from missing permission validation in the export or import app functionality.

An authenticated user without the required permissions can download app archives, leading to exposure of sensitive information and proprietary source code contained within those archives. The vulnerability does not affect integrity or availability but results in a confidentiality breach. There are no known exploits in the wild at this time.

A fix is available in Splunk SOAR version 8.7.0 and later. Users should upgrade to version 8.7.0 or above to remediate this vulnerability. Until then, restrict authenticated user roles to only those with necessary permissions and monitor access controls carefully. No vendor advisory content contradicts this guidance.