CVE-2025-22621: Splunk App For Soar

Medium severity, CVSS 6.4. EPSS: 0.3% chance of exploitation in the next 30 days.

In versions 1.0.67 and lower of the Splunk App for SOAR, the Splunk documentation for that app recommended adding the `admin_all_objects` capability to the `splunk_app_soar` role. This addition could lead to improper access control for a low-privileged user that does not hold the "admin" Splunk roles.

Affected products

• Splunk Splunk App For Soar: from 1.0, before 1.0.71 (fixed in 1.0.71)

Published 2025-01-07. Last modified 2026-06-17.