CVE-2026-76305 Splunk CVE debrief

Who should care

Splunk SOAR administrators and users with app management roles should assess exposure and verify app archive permissions to prevent unauthorized access to sensitive information. This includes reviewing current app archive permissions, restricting access to authorized roles, and monitoring for unauthorized app archive downloads. Additionally, security teams should review compensating controls for exposed systems and ensure proper access controls are inplace

Why it matters

CVE-2026-76305 allows an authenticated user without app view permission to download an app archive in Splunk SOAR versions below 8.7.0, potentially exposing sensitive information. Defenders should assess exposure, verify permissions, and restrict access to prevent unauthorized access.

• Potential exposure of proprietary source code
• Possible unauthorized access to sensitive information
• Need to verify app archive permissions
• Requirement to restrict app archive access to authorized roles

Technical summary

In Splunk SOAR versions below 8.7.0, an authenticated user without permission to view apps can download an app archive. This could expose proprietary source code and sensitive information because Splunk SOAR does not verify permission to view apps before returning the app archive. The vulnerability is due to inadequate access controls on app archives, allowing unauthorized access to potentially sensitive data. Defenders should assess exposure, verify permissions, and restrict access to prevent unauthorized access. This issue highlights the importance of proper access control and permission management in Splunk SOAR deployments.

Defensive priority

Assess exposure and verify app archive permissions

Recommended defensive actions

• Verify app archive permissions in Splunk SOAR versions below 8.7.0
• Assess exposure of proprietary source code and sensitive information
• Restrict app archive access to authorized roles
• Monitor for unauthorized app archive downloads
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability allows an authenticated user without app view permission to download an app archive, potentially exposing proprietary source code and sensitive information. This is due to a lack of permission verification before returning the app archive.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.