Splunk SOAR prior to version 8.7.0 contains a flaw in its REST API whereby users who possess the Users and Roles view permission can craft query filters on sensitive user fields. By controlling these filters, the privileged user can infer authentication token values belonging to other users. If the deduced token grants administrative rights, the attacker effectively gains administrator access to the entire Splunk SOAR instance. This vulnerability is classified as a sensitive information disclosure (CWE-200) that can potentially lead to full system compromise.

Splunk SOAR versions below 8.7.0 are affected. The vulnerability is present in all installations of Splunk SOAR running any version prior to 8.7.0, irrespective of deployment type or operating system.

With a CVSS score of 7.2, the risk is considered moderate to high. The EPSS score was not disclosed, so the likelihood of exploitation is uncertain but can be presumed to be moderate given the nature of the attack. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated user with the Users and Roles view permission to interact with the REST API; the attacker must send specially crafted query filters to other user records to glean token values. Successful exploitation results in the attacker acquiring administrative privileges, enabling full control of the Splunk SOAR instance.