Description

In versions below 3.2.2 of the Zoom app for Splunk SOAR, a user who holds a role with permission to run actions could expose meeting and personal meeting ID passwords by invoking one of the create meeting, update meeting, or update user settings actions, because the affected password and pmi_password parameters are not masked and are shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameters as passwords. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T22:17:24.833Z",
  "pubdate": "2026-08-19T22:17:24.833Z",
  "executiveSummary": "An information disclosure vulnerability exists in versions below 3.2.2 of the Zoom app for Splunk SOAR.\nThe vulnerability allows a user with permissions to run actions to expose sensitive Zoom meeting passwords and personal meeting ID passwords in cleartext.\nThe affected components are the create meeting, update meeting, and update user settings actions, specifically due to unmasked password and pmi_password parameters.\nRisk implications include the unauthorized exposure of confidential meeting credentials within the user interface.\nAttacker capabilities require authenticated access with permissions to execute SOAR actions, enabling them to view sensitive parameter values directly in the user interface during execution.",
  "technicalDetails": "The root cause of the vulnerability is the failure of the Zoom app for Splunk SOAR to properly mark sensitive action parameters as passwords.\nSpecifically, the password and pmi_password parameters utilized within the create meeting, update meeting, and update user settings actions lack the necessary configuration to enforce masking within the interface.\nPrivilege requirements dictate that the user must hold a role with permissions to run actions within Splunk SOAR.\nAuthentication is required as the user must interact with the user interface to invoke the affected actions.\nThe attack flow begins when an authorized user invokes one of the vulnerable actions: create meeting, update meeting, or update user settings.\nDuring the execution or logging phase within the user interface, the input parameters password and pmi_password are rendered and displayed in cleartext rather than being obfuscated or masked.\nConsequently, any user with interface visibility into the executed action parameters can harvest these sensitive meeting and personal meeting ID passwords.\nThe affected versions comprise all iterations of the Zoom app for Splunk SOAR prior to version 3.2.2.\nThe post-exploitation impact centers on unauthorized access to confidential Zoom meetings and compromised personal meeting IDs resulting from the cleartext leakage of authentication parameters."
}