CVE-2026-76386: The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere. in Splunk Zoom app for Splunk SOAR

In the Zoom app for Splunk SOAR versions >=3.2 and <3.2.2, the parameters 'password' and 'pmi_password' used in create meeting, update meeting, or update user settings actions are not masked. Consequently, users with roles that allow running these actions can see these sensitive passwords in cleartext in the user interface. This is due to the app not marking these parameters as passwords, leading to potential information disclosure.

The vulnerability allows users with permission to run specific actions in the Zoom app for Splunk SOAR to view sensitive meeting passwords in cleartext. This could lead to unauthorized access to meetings if the exposed passwords are misused. However, the impact is limited to information disclosure without direct integrity or availability effects.

A fixed version 3.2.2 or later should be used to remediate this issue. Users should upgrade to version 3.2.2 or higher where the password parameters are properly masked. Until then, restrict permissions to run affected actions to trusted users only. Patch status is confirmed by the version range indicating fixed in 3.2.2.