CVE-2026-76255: The software does not perform an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise, a user without admin or power roles can exploit a lack of authorization checks in the Data Model Editor to cause another user to run arbitrary Search Processing Language (SPL) commands with the victim's permissions. This is due to the absence of SPL safeguards for risky commands when the Data Model Editor runs base searches for auto-extracted fields. The attack requires social engineering to trick the victim into initiating a browser request, enabling unauthorized data access and potential system integrity impact.

Successful exploitation allows an attacker to execute arbitrary SPL commands with the privileges of the targeted user, potentially accessing all data available to that user and affecting system integrity. However, the attacker cannot exploit this vulnerability at will and must rely on phishing to induce the victim to perform the action. There is no indication of impact to availability. The CVSS score of 6.4 reflects a medium severity with high confidentiality and integrity impact but requires user interaction and has high attack complexity.

Splunk has released fixed versions 10.4.1, 10.2.6, 10.0.8, and 9.4.13 that address this vulnerability. Users should upgrade to these or later versions to remediate the issue. Additionally, reviewing and enforcing strict role definitions and capabilities in Splunk can reduce risk. The vulnerability requires phishing and user interaction, so user awareness and training may also help mitigate exploitation risk.