CVE-2026-76264: The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. in Splunk Splunk Enterprise

In Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a flaw in the authorization checks allows users lacking the 'admin' or 'power' roles to create or modify scripted lookup definitions through raw configuration endpoints. The vulnerability arises because raw transforms configuration write paths do not apply external lookup capability checks before saving scripted lookup settings, enabling unauthorized modification of these configurations.

Attackers with limited privileges can bypass intended access restrictions to create or edit scripted lookup definitions, potentially leading to unauthorized changes in Splunk Enterprise configurations. The CVSS score of 4.3 reflects a medium impact with no confidentiality or availability impact but with integrity impact due to unauthorized modification capabilities.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.10, and 9.4.15. Users should upgrade to these or later versions to remediate the vulnerability. No additional mitigation steps are indicated beyond applying the official patches.