In Splunk SOAR versions prior to 8.7.0, an authenticated user who does not possess a role that grants view‑app permissions can trigger a download of an installed app archive. The archive contains all data stored in the app, including proprietary source code and sensitive information, potentially leading to data exposure and intellectual property theft. The weakness is an improper access control flaw, where the system fails to verify user authorization before providing download access.

The affected product is Splunk SOAR versions below 8.7.0. Users with standard or elevated roles that lack explicit view‑app permissions are vulnerable in these releases.

The CVSS score of 6.5 indicates a moderate severity risk. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of widespread exploitation is currently uncertain, but it remains exploitable by any authenticated user who can access the download endpoint. The attack vector is inferred to be authenticated and internal, requiring no special network access beyond standard login credentials.