CVE-2026-76368: The software does not perform an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk SOAR
CVE-2026-76368 is a low-severity authorization vulnerability in Splunk SOAR versions below 8.6.0. It allows users with the playbooks:view permission to view metadata about playbook repositories they are not authorized to access. This occurs because Playbook History does not verify repository permissions before returning playbook revision metadata.
AI Analysis
Technical Summary
In Splunk SOAR versions prior to 8.6.0, a lack of authorization checks in the Playbook History feature permits users holding roles with the playbooks:view permission to access metadata of playbook repositories without proper authorization. This vulnerability arises from the failure to enforce repository permission checks before disclosing playbook revision metadata, potentially exposing sensitive repository information to unauthorized users.
Potential Impact
The vulnerability allows unauthorized disclosure of metadata related to playbook repositories. The impact is limited to information disclosure (confidentiality) with no integrity or availability effects. The CVSS score of 2.7 reflects a low severity due to the requirement of high privileges (PR:H) and the limited impact (confidentiality only).
Mitigation Recommendations
No official patch or remediation level is currently stated. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, review and restrict roles that include the playbooks:view permission to trusted users only to minimize exposure.
CVE-2026-76368: The software does not perform an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk SOAR
Description
CVE-2026-76368 is a low-severity authorization vulnerability in Splunk SOAR versions below 8.6.0. It allows users with the playbooks:view permission to view metadata about playbook repositories they are not authorized to access. This occurs because Playbook History does not verify repository permissions before returning playbook revision metadata.
CVSS v3.1
Score 2.7low
Affected software
pkg:github/splunk/splunk-soarRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Splunk SOAR versions prior to 8.6.0, a lack of authorization checks in the Playbook History feature permits users holding roles with the playbooks:view permission to access metadata of playbook repositories without proper authorization. This vulnerability arises from the failure to enforce repository permission checks before disclosing playbook revision metadata, potentially exposing sensitive repository information to unauthorized users.
Potential Impact
The vulnerability allows unauthorized disclosure of metadata related to playbook repositories. The impact is limited to information disclosure (confidentiality) with no integrity or availability effects. The CVSS score of 2.7 reflects a low severity due to the requirement of high privileges (PR:H) and the limited impact (confidentiality only).
Mitigation Recommendations
No official patch or remediation level is currently stated. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, review and restrict roles that include the playbooks:view permission to trusted users only to minimize exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- cisco
- Date Reserved
- 2026-08-19T12:02:03.629Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a86225dacd9273b49a7040f
Added to database: 08/19/2026, 21:38:37 UTC
Last enriched: 08/19/2026, 22:23:13 UTC
Last updated: 08/20/2026, 00:42:14 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.