The vulnerability lies in the way Splunk SOAR processes REST API query filters in versions below 8.7.0. A user assigned the Observer role can craft query filters that retrieve user records before sensitive fields are sanitized, allowing the observer to infer password hashes and authorization tokens of other users. This flaw directly compromises confidentiality, as attackers can gain internals of other accounts without direct authentication to those accounts.

Splunk SOAR on-premises installations running any version earlier than 8.7.0 are affected. The flaw is linked to the Observer role in the role and permission model of Splunk SOAR.

The CVSS score of 7.5 indicates moderate to high severity. The EPSS score is not available, so the current exploitation likelihood cannot be quantified, but the vulnerability is not listed in CISA KEV, implying no known live exploitation campaign yet. The likely attack vector requires a valid Observer‑role account that can issue REST API queries, which means compromised or mis‑granted internal accounts could exploit this flaw without further access escalation.