Description

In Splunk SOAR versions below 8.6.0, an authenticated user with restricted tenant access could use the Representational State Transfer (REST) API to view the names and identifiers of tenants that fall outside the role scope for that user. The vulnerability is possible because Splunk SOAR does not enforce role-based tenant restrictions when it returns tenant information through the REST API in deployments with multi-tenancy turned on. For more information see REST Roles and Permissions (https://help.splunk.com/en/splunk-soar/soar-cloud/rest-api-reference/role-management-endpoints/rest-roles-and-permissions) and Configure multiple tenants on your Splunk SOAR (On-premises) instance (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/7.1.0/configure-product-settings-for-your-splunk-soar-on-premises-instance/configure-multiple-tenants-on-your-splunk-soar-on-premises-instance) in the Splunk documentation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T22:17:22.733Z",
  "pubdate": "2026-08-19T22:17:22.733Z",
  "executiveSummary": "An information disclosure vulnerability exists in Splunk SOAR in deployments with multi-tenancy enabled. The flaw arises due to the application failing to properly enforce role-based tenant restrictions when processing requests via the Representational State Transfer (REST) API. An authenticated user possessing restricted tenant access can leverage the REST API to query and retrieve the names and unique identifiers of tenants that explicitly fall outside their assigned role scope. The primary impact of this vulnerability is unauthorized enumeration of tenant metadata, which compromises tenant isolation boundaries in multi-tenant environments. The affected product is Splunk SOAR for versions below 8.6.0. The risk implications include the exposure of sensitive organizational structure and tenant identifiers to unauthorized internal actors, potentially facilitating further reconnaissance or targeted attacks. Exploitation of this vulnerability requires valid authentication within the system and restricted tenant access privileges, coupled with multi-tenancy being activated on the deployment.",
  "technicalDetails": "The vulnerability stems from an authorization enforcement failure within the REST API component of Splunk SOAR when multi-tenancy is turned on. Specifically, the affected component fails to validate the requesting user's role-based tenant scope against the requested resource metadata during API query processing. Consequently, when an authenticated user with restricted tenant privileges issues specific API requests, the backend application processes the request and returns tenant information globally rather than filtering the result set based on the user's authorized role scope. The root cause is categorized as a broken access control flaw at the API layer, specifically an omission of authorization checks for tenant resource enumeration. The attack flow begins with an authenticated attacker possessing limited or restricted tenant privileges. The attacker interacts directly with the Representational State Transfer (REST) API endpoints responsible for tenant management and retrieval. By issuing standard API queries, the attacker bypasses logical role boundaries because the application executes the query without validating authorization parameters. The server responds by returning a payload containing the names and identifiers of all tenants configured in the instance, including those outside the attacker's permitted scope. The authentication requirement is low, as the attacker must be an authenticated user, albeit one with restricted tenant access. Privilege requirements are similarly constrained to a standard user role lacking global administrative rights. Network exposure is tied to the accessibility of the Splunk SOAR REST API interface. The post-exploitation impact is limited to information disclosure, specifically the unauthorized gathering of system topology and tenant identifiers, which provides reconnaissance data that could be utilized in subsequent multi-tenant security bypass attempts."
}