CVE-2026-76263: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. in Splunk Splunk Enterprise

In Splunk Enterprise versions >=10.2 <10.2.6 and >=10.4 <10.4.2, a user lacking admin or power roles can delete SPL2 modules belonging to other users via the data management orchestrator interface. This occurs because the authorization mechanism does not confirm that the requesting user owns the target resource before permitting deletion, resulting in broken object-level authorization. Versions below 10.2 are not affected.

An unauthorized user with limited privileges can delete SPL2 modules owned by other users, potentially disrupting data processing or application functionality. The vulnerability does not allow data confidentiality compromise but impacts integrity and availability of user modules.

Upgrade Splunk Enterprise to version 10.2.6 or later if using the 10.2 branch, or to version 10.4.2 or later if using the 10.4 branch, where this authorization issue is fixed. No other mitigations are indicated. Patch status is confirmed by the version ranges provided.