CVE-2025-22621

Name of the Vulnerable Software and Affected Versions Splunk App for SOAR versions 1.0.67 and lower

Description The issue is related to improper access control. In the affected versions of the Splunk App for SOAR, the documentation recommended adding the admin all objects capability to the splunk app soar role. This could lead to improper access control for a low-privileged user that does not hold the "admin" Splunk roles.

Recommendations For versions 1.0.67 and lower, remove the admin all objects capability from the splunk app soar role to prevent improper access control. As a temporary workaround, consider restricting the splunk app soar role to minimize the risk of exploitation.