In versions below 1.5.2 of the MS Graph for Active Directory app for Splunk SOAR, a user who holds a role with permission to run actions could… (CVE-2026-76381)

The MS Graph for Active Directory app for Splunk SOAR versions prior to 1.5.2 contain an information disclosure vulnerability (CVE-2026-76381). Users with roles that permit running actions can invoke the reset password action, which includes a temp_password parameter that is displayed in cleartext in the UI. This happens because the parameter is not designated as a password type, leading to exposure of sensitive password information. The vulnerability is classified under CWE-312 (Cleartext Storage of Sensitive Information).

An attacker or user with permission to run actions in the affected app versions can view sensitive password information in cleartext within the user interface. This could lead to unauthorized access if the exposed password is reused or leveraged in other attacks. There is no indication of integrity or availability impact. The CVSS score is 4.3 (medium severity), reflecting the limited scope and required privileges.

A fix is available in version 1.5.2 of the MS Graph for Active Directory app for Splunk SOAR, which addresses this issue by properly masking the temp_password parameter. Users should upgrade to version 1.5.2 or later to remediate this vulnerability. No other mitigation guidance is provided or necessary.