CVE-2026-76530

{
  "etk_id": "ETK-2026-2386",
  "cve_id": "CVE-2026-76530",
  "display_id": "CVE-2026-76530",
  "ghsa_id": "GHSA-6vr6-2g9h-34wg",
  "euvd_id": "EUVD-2026-107635",
  "status": "published",
  "anchor_state": "anchored",
  "title": "URL path authorization bypass in Splunk SOAR",
  "summary": "Splunk SOAR is affected by inconsistent handling of URL path representations during access-control decisions. An attacker who can reach relevant application endpoints may be able to have authorization evaluated against a different path representation than the resource ultimately accessed.",
  "mitigation": "Apply the vendor's hardening release for this issue when it is available for the deployed Splunk SOAR version. Until then, limit access to SOAR web endpoints to trusted networks and authenticated users.",
  "vendor": "Splunk",
  "product": "Splunk SOAR",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 8.7.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "8.7.0"
      ],
      "package_name": "Splunk SOAR",
      "purl": null
    }
  ],
  "cwes": [
    647
  ],
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": null,
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 31.031495583333335,
  "t0_at": "2026-10-21T22:52:19.125000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-21T22:52:19.125000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-21T22:52:19.125000+00:00",
      "url": "https://github.com/advisories/GHSA-6vr6-2g9h-34wg"
    }
  }
}