Improper Access Control in Splunk App for SOAR by Splunk

CVE-2025-22621

Summary

Versions of the Splunk App for SOAR up to and including 1.0.67 contain a vulnerability that stems from the Splunk documentation suggesting the addition of the 'admin_all_objects' capability to the 'splunk_app_soar' role. This misconfiguration could allow low-privileged users without the appropriate 'admin' roles to gain unauthorized access to critical application functions, potentially leading to unauthorized data exposure or manipulation. It is crucial for users to review their role assignments and ensure that access controls are appropriately set to mitigate this risk.

References