Splunk SOAR versions older than 8..0 allow a privileged user with the install_apps capability to embed attacker‑controlled content into an app’s documentation page. When another user who has permission to view that documentation opens the page, the malicious code runs in the victim’s browser. The attacker can then read or modify data that the victim’s account has access to. This stored cross‑site scripting flaw arises because the application fails to sanitise the documentation content before rendering it.

All Splunk SOAR deployments running version 8.6.x or earlier. The vulnerability is tied to the ability to install and publish apps and is present in any environment where the install_apps privilege is granted to a user.

The vulnerability carries a CVSS score of 5.7, indicating a moderate severity. An exploit requires that the attacker persuade a target user to open the compromised documentation page, typically via phishing or social engineering. The EPSS score is not available, so the likelihood of widespread exploitation cannot be quantified precisely. The issue is not listed in the CISA KEV catalog, but the client‑side nature means any user who opens the page can be compromised if they possess the required view permission.