CVE-2026-76307: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. in Splunk Splunk SOAR

In Splunk SOAR versions below 8.7.0, a user assigned a role with the Users and Roles view permission can leverage the REST API to infer authentication token values for other users. If the inferred token corresponds to an administrative user, the attacker can escalate privileges to gain administrative access to the Splunk SOAR instance. This vulnerability exists because the REST API accepts caller-controlled query filters on sensitive user record fields, which allows unauthorized inference of sensitive authentication tokens.

An attacker with a role that includes the Users and Roles view permission can infer authentication tokens of other users via the REST API. If the attacker infers a token with administrative privileges, they can gain full administrative access to the Splunk SOAR instance, potentially compromising confidentiality, integrity, and availability of the system.

A fix is available in Splunk SOAR version 8.7.0 and later. Users should upgrade to version 8.7.0 or higher to remediate this vulnerability. No additional mitigation steps are indicated in the provided data.