Cross-Site Scripting in Splunk SOAR Affecting Users with App Installation Permissions

CVE-2026-76303

What is CVE-2026-76303?

In Splunk SOAR versions prior to 8.7.0, a vulnerability exists that allows users with the install_apps capability to embed attacker-controlled content within app documentation. When users with the ability to view apps access this documentation, the malicious content can execute in their browser. This creates opportunities for unauthorized data access and modifications. Such an exploit relies on user interaction; successful phishing must occur for the attacker to execute their code. Notably, the application fails to sanitize the displayed content, leaving users exposed to potential risks during interaction with app documentation.

References