CVE-2026-76370: The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. in Splunk Splunk SOAR

In Splunk SOAR versions below 8.6.0, the REST API fails to enforce role-based tenant restrictions properly. An authenticated user with limited tenant access can exploit this flaw to retrieve names and identifiers of tenants beyond their role scope. The vulnerability arises from incorrect authorization checks in multi-tenant configurations, allowing information disclosure of tenant data that should be restricted. This issue is documented in Splunk's REST Roles and Permissions and multi-tenancy configuration guides.

The vulnerability allows unauthorized disclosure of tenant names and identifiers to authenticated users with restricted tenant access. It does not affect data integrity or availability, nor does it allow privilege escalation or remote code execution. The impact is limited to information disclosure of tenant metadata outside the user's authorized scope.

Upgrade Splunk SOAR to version 8.6.0 or later, where this authorization check issue is fixed. Since this is an on-premises product, administrators should apply the official update to remediate the vulnerability. No vendor advisory content was provided explicitly stating patch availability, but the affected versions indicate that 8.6.0 is the fixed version.