Splunk

CVE-2026-76305: In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive of an installed app.

CVE-2026-76305 Oct 21, 2026 Source: Vendor

In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive of an installed app. This could expose all data in the app archive, including proprietary source code and sensitive information.
The vulnerability is possible because Splunk SOAR does not verify permission to view apps before it returns the app archive.
For more information see Export or import an app (https://help.splunk.com/en/splunk-soar/soar-on-premises/d

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-76305

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

1 line

Showing 1–1 of 1

CVE-2026-76305 BR2026-0000-030269 unclaimed

Credited as Gabriel Nitu, Splunk