Splunk SOAR: Authentication token inference and privilege escalation (CVE-2026-76307)

Splunk SOAR versions below 8.7.0 contain an authentication vulnerability (CVE-2026-76307) that allows a user with "Users and Roles" view permissions to infer authentication tokens belonging to other users. The vulnerability arises because the REST API permits caller-controlled query filters on sensitive user record fields. By targeting these fields, a standard user can obtain tokens and potentially escalate privileges to administrative levels.

Impact

Successful exploitation allows a non-privileged user with specific view permissions to obtain administrative authentication tokens, leading to full unauthorized control over the Splunk SOAR instance.

Recommendation

• Upgrade Splunk SOAR to version 8.7.0 or later immediately.
• Review existing role-based access control (RBAC) configurations in Splunk SOAR to ensure that "Users and Roles" view permissions are granted only to strictly authorized personnel.
• Audit REST API logs for anomalous query patterns targeting sensitive user record fields or repetitive filter attempts.