In Splunk FireAMP versions =2.1, the add listitem action in the FireAMP connector is incorrectly classified as read-only in the action manifest. This allows users with roles capable of editing, creating, or running playbooks in Splunk SOAR to perform unauthorized changes to file lists by running this action in a Safe Mode playbook. The root cause is a permissions specification flaw in the action manifest that does not reflect the actual update capability of the add listitem action.

The vulnerability allows users with certain elevated roles in Splunk SOAR to make unauthorized modifications to file lists via the add listitem action. The impact is limited to integrity (unauthorized changes) without confidentiality or availability effects. The CVSS score of 2.7 and vector indicate a low severity with network attack vector, low complexity, and required privileges.

Patch status is not confirmed; no official fix or remediation level is provided in the vendor advisory. Users should monitor the vendor advisory for updates and consider restricting roles that can edit, create, or run playbooks in Splunk SOAR to trusted personnel only until a fix is available.