CVE-2026-76251: The software does not perform an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise, the Splunk App for Splunk Observability Cloud fails to perform an authorization check (specifically the read_o11y_content capability) before forwarding requests to Splunk Observability Cloud. This allows users lacking admin or power roles to leverage the stored access token to view data accessible to that token and make limited modifications to Splunk Observability Cloud content. The vulnerability is present in versions >=10.0 <10.0.9, >=10.2 <10.2.6, and >=10.4 <10.4.2. The root cause is missing enforcement of role-based capability checks in the app's REST API endpoint handlers.

An attacker with a user role below admin or power can access the Splunk Observability Cloud access token stored by the app, enabling them to view all data accessible to that token and perform limited changes in Splunk Observability Cloud. This results in a confidentiality breach (high impact) and limited integrity impact. There is no impact on availability. The vulnerability does not affect earlier versions 9.3 and 9.4.

A fix is available in Splunk Enterprise versions 10.0.9, 10.2.6, and 10.4.2 and later. Users should upgrade to these or later versions to remediate the vulnerability. Since this is an on-premises product, administrators must apply the update. No vendor advisory content contradicts this; thus, upgrading is the recommended mitigation.