Description

In Splunk SOAR versions below 8.6.0, a user who holds a role that contains the playbooks:view permission could view metadata about a playbook repository that they are not authorized to view. The vulnerability is possible because Playbook History does not check repository permissions before returning playbook revision metadata. For more information see Manage roles and permissions in Splunk SOAR (Cloud) (https://help.splunk.com/en/splunk-soar/soar-cloud/administer-soar-cloud/manage-your-splunk-soar-cloud-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-cloud) and Manage settings for a playbook in Splunk SOAR (Cloud) (https://help.splunk.com/en/splunk-soar/soar-cloud/build-playbooks/manage-playbooks-and-playbook-settings/manage-settings-for-a-playbook-in-splunk-soar-cloud) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-08-19T22:17:22.457Z",
  "pubdate": "2026-08-19T22:17:22.457Z",
  "executiveSummary": "An information disclosure vulnerability exists in Splunk SOAR versions below 8.6.0. The vulnerability allows an authenticated user assigned a role containing the playbooks:view permission to view metadata associated with playbook repositories that they are explicitly not authorized to access. The root cause stems from the Playbook History component failing to properly enforce authorization checks against repository-level permissions prior to returning playbook revision metadata. This security flaw impacts confidentiality by exposing sensitive operational metadata across restricted repository boundaries. Exploitation requires authenticated access to the platform with baseline playbook viewing privileges, enabling unauthorized users to harvest structural and historical insights into restricted automated workflows without requiring elevated administrative rights.",
  "technicalDetails": "The vulnerability resides within the access control logic governing playbook repository handling in Splunk SOAR versions prior to 8.6.0. Specifically, the Playbook History subsystem fails to validate the requesting user's authorization boundaries against targeted playbook repositories before servicing requests for revision metadata. Normally, security controls dictate that access to playbooks and their associated repositories must be restricted based on granular role-based access control configurations managed through administrative settings. However, when a user holds a role possessing the broad playbooks:view permission, the lack of contextual repository-level validation in the Playbook History component permits the retrieval of revision histories and associated metadata from unauthorized repositories.\nThe attack flow proceeds as follows: An authenticated actor possessing a role configured with the playbooks:view permission targets a playbook repository for which they lack explicit authorization. The user initiates a request directed at the Playbook History feature to retrieve revision metadata. The vulnerable component processes the request, bypassing repository-level authorization checks that should normally validate whether the user's role has permission to access the specific repository scope. Consequently, the backend returns the requested playbook revision metadata, exposing structural details, modification histories, and potentially sensitive organizational workflow data to an unauthorized entity. The vulnerability is exploitable via standard application functionality interface channels by any authenticated user meeting the minimal privilege threshold of the playbooks:view permission, operating within the boundaries of the local network exposure of the Splunk SOAR deployment."
}