Splunk SOAR CVE-2026-76306

Requires an authenticated account holding the Splunk SOAR 'Observer' role (low privilege, PR:L) on an on-premises instance running a version below 8.7.0; the attacker then submits REST API queries whose filter clauses are evaluated against user records before Splunk SOAR strips sensitive fields, exposing other users' password hashes and authorization tokens. Limiting factors: exploitation is NOT possible unauthenticated - a valid Observer (or higher) account is mandatory - and only affects SOAR On-premises builds earlier than the 8.7.0 fix; the AC:H rating reflects that extraction is performed indirectly through crafted filters rather than a single direct read.

The vendor CVSS of 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) is driven mainly by the network attack vector and the claim of High impact across Confidentiality, Integrity and Availability. The primary flaw, however, is a CWE-200 information disclosure: an authenticated low-privileged 'Observer' user (PR:L) can abuse REST API query filters to read password hashes and authorization tokens belonging to other users. The direct impact is confidentiality (C:H is well supported); the vendor's I:H and A:H ratings appear to reflect the DOWNSTREAM consequence that stolen authorization tokens and crackable hashes let an attacker impersonate higher-privileged accounts and escalate - not a direct integrity/availability defect - so treat those metrics as secondary-impact-driven rather than direct, and verify against SVD-2026-1010. AC:H signals the exploit requires more than a single trivial request (iterative/blind inference through filter behavior), which modestly lowers ease. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: this is a credible privilege-escalation-enabling disclosure but gated behind valid authenticated access to a specialized SOC product, making it a prioritized internal-threat/insider and lateral-movement concern rather than a mass-exploited internet-facing emergency.

A low-privileged user holding the 'Observer' role (or an attacker who has compromised such an account) crafts REST API queries against user records with filters that are evaluated before Splunk SOAR masks sensitive fields, causing the API to leak or allow inference of other users' password hashes and authorization tokens. The attacker then reuses a stolen authorization token or cracks an administrator's hash to impersonate a higher-privileged account within the SOAR platform. No public exploit code was identified at time of analysis.