CVE-2026-76308: The software does not perform an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk SOAR

In Splunk SOAR versions below 8.7.0, an authorization bypass vulnerability exists in the REST API managing the Enterprise Security edition license. Although the system authenticates users, it does not perform an authorization check before applying license changes, allowing any authenticated user to alter the license. This could lead to unauthorized license modifications impacting the integrity of license management.

The vulnerability allows an authenticated user with low privileges to modify the Enterprise Security edition license via the REST API without proper authorization. This does not impact confidentiality or availability but results in a high integrity impact due to unauthorized license changes. There is no indication of exploitation in the wild.

Upgrade to Splunk SOAR version 8.7.0 or later, where this authorization check vulnerability has been addressed. Since the vendor advisory is not explicitly provided, patch status is inferred from the affected versions indicating the fix in 8.7.0. Until upgrade, restrict access to the REST API to trusted users only.