CVE-2026-76306: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. in Splunk Splunk SOAR

In Splunk SOAR versions below 8.7.0, a user assigned the 'Observer' role can exploit the REST API query filters to infer sensitive information such as password hashes and authorization tokens belonging to other users. The root cause is that the REST API applies query filters to user records prior to masking or protecting sensitive fields, allowing unauthorized actors to access data they should not have. This vulnerability affects versions from initial releases up to but not including 8.7.0.

An attacker with the 'Observer' role, which is typically a low-privilege role, can gain access to highly sensitive information including password hashes and authorization tokens of other users. This can lead to credential compromise, unauthorized access, and potential full system compromise depending on the use of these credentials. The CVSS 3.1 score of 7.5 (high) reflects the network attack vector, required low privileges, and high impact on confidentiality, integrity, and availability.

Upgrade Splunk SOAR to version 8.7.0 or later where this vulnerability is fixed. Since this is an on-premises product and no cloud service remediation applies, administrators should apply the official patch or upgrade as soon as possible. Until patched, restrict the assignment of the 'Observer' role to trusted users only and monitor for suspicious API usage. Patch status is confirmed fixed in version 8.7.0.