EUVD-2026-62933
GHSA-r2gx-xq4h-2w26
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Any user with the playbooks:view role, not necessarily an administrator, can exploit this; PR:L better reflects the access bar than the vendor-assigned PR:H.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
In Splunk SOAR versions below 8.6.0, a user who holds a role that contains the playbooks:view permission could view metadata about a playbook repository that they are not authorized to view. The vulnerability is possible because Playbook History does not check repository permissions before returning playbook revision metadata. For more information see Manage roles and permissions in Splunk SOAR (Cloud) (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) and Manage settings for a playbook in Splunk SOAR (Cloud) (https://help.splunk.com/en/splunk-soar/soar-cloud/build-playbooks/manage-playbooks-and-playbook-settings/manage-settings-for-a-playbook-in-splunk-soar-cloud) in the Splunk documentation.
AnalysisAI
Splunk SOAR versions below 8.6.0 expose a missing authorization flaw in the Playbook History feature that allows authenticated users holding the playbooks:view permission to read metadata about playbook repositories they are not explicitly authorized to access. The Playbook History endpoint omits repository-level permission checks before returning revision metadata, enabling unauthorized information disclosure within role-segregated SOAR deployments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active authenticated session in Splunk SOAR with a user account assigned a role that includes the `playbooks:view` permission. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The real-world risk is low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Splunk SOAR user assigned a role that includes the `playbooks:view` permission navigates to the Playbook History interface and queries a repository they have not been explicitly authorized to view. Because the history endpoint omits repository-level permission checks, the platform returns revision metadata - including playbook names, version timestamps, and authorship records - for the unauthorized repository without triggering an access denial. … |
| Remediation | The primary remediation is to upgrade Splunk SOAR to version 8.6.0 or later, where the missing repository-level authorization check in Playbook History has been corrected; the vendor advisory at https://advisory.splunk.com/advisories/SVD-2026-0804 provides upgrade procedures. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10, a low-privileged user that does not hold the admin or powe
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet la
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100,
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system c
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream col
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘pivot’ search processing language (SPL) command lets
In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more
In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on t
In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.2.2403.100, an a
Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today