Unauthorized License Modification in Splunk SOAR Affecting Enterprise Security Edition

CVE-2026-76308

What is CVE-2026-76308?

In earlier versions of Splunk SOAR (prior to 8.7.0), an authenticated user can exploit an oversight in the REST API that permits changing the Enterprise Security edition without proper authorization checks. This vulnerability arises because, while requests to manage the Enterprise Security edition are authenticated, the system fails to validate whether the user has the necessary permissions to enact a license change. As a result, this could lead to unauthorized alterations of licensed features, impacting security posture and operational integrity. For further details, reference the official Splunk documentation and advisory linked in the references.

References