In versions below 3.2.2 of the Zoom app for Splunk SOAR, a user who holds a role with permission to run actions could expose meeting and personal… (CVE-2026-76386)
Description
Versions of the Zoom app for Splunk SOAR below 3.2.2 contain an information disclosure vulnerability where meeting and personal meeting ID passwords are exposed in cleartext in the user interface. This occurs because the affected password parameters are not masked when users with permission to run actions invoke certain meeting-related actions. The vulnerability does not affect availability or integrity and requires privileges to run actions.
CVSS v3.1
Score 4.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Zoom app versions below 3.2.2 for Splunk SOAR, a user role with permission to run actions can cause meeting and personal meeting ID passwords to be displayed in cleartext in the user interface. This is due to the app not marking the 'password' and 'pmi_password' parameters as sensitive, resulting in unmasked exposure when invoking create meeting, update meeting, or update user settings actions. The vulnerability is classified as CWE-312 (Cleartext Storage of Sensitive Information).
Potential Impact
The vulnerability allows disclosure of meeting and personal meeting ID passwords to users with action execution permissions, potentially exposing sensitive meeting credentials. There is no impact on system availability or integrity. The CVSS v3.1 base score is 4.3 (medium severity), reflecting the limited scope and required privileges.
Mitigation Recommendations
A fixed version 3.2.2 or later addresses this issue by masking the affected password parameters. Users should upgrade to version 3.2.2 or later to remediate this vulnerability. No other mitigation guidance is provided or necessary.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-2mg7-2hgc-pq9p
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-76386"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a870a86acd9273b49b59868
Added to database: 08/20/2026, 14:09:10 UTC
Last enriched: 08/20/2026, 14:42:18 UTC
Last updated: 10/05/2026, 06:48:18 UTC
Views: 29
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.