The vulnerability arises from the software’s use of non‑canonical URL paths when making authorization decisions. Because the system does not normalize or validate the requested path, an attacker can craft a request that bypasses the intended permission checks, potentially granting access to resources or actions that should be restricted. This flaw falls under CWE‑647, indicating inadequate validation of permissions and leading to an authorization bypass. The described impact is that an attacker might obtain unauthorized access to protected data or functionalities within Splunk SOAR.

Splunk SOAR deployments using versions earlier than 8.7.0 are affected. The exact range of vulnerable releases is not listed; any installation that has not applied the 8.7.0 or later patch is presumed vulnerable.

The EPSS score is <1%, indicating a very low but nonzero exploitation probability. KEV status is not listed. The CVSS score is 8.8. The described vulnerability enables a direct privilege escalation via crafted URLs, making the risk high for systems that are publicly accessible. The likely attack vector is remote, involving HTTP/HTTPS requests directed at the SOAR web interface. Since no exploits are listed in KEV, there may not yet be known public exploitation, but the flaw remains severe enough to warrant immediate remediation.