CVE-2026-76269: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise, the REST API responsible for returning search job information fails to properly verify that the requesting user owns the job identified by a user-controlled job identifier. As a result, users without admin or power roles can access substantial search job data from other users, including sensitive query text and results. This is due to insufficient authorization checks in the API implementation.

The vulnerability allows unauthorized users with lower privileges to access sensitive search job information from other users. This includes the content of search queries, metadata, and results, potentially exposing confidential data. There is no indication of impact on data integrity or availability. The CVSS score of 6.5 reflects a medium severity with high confidentiality impact but no integrity or availability impact.

A fix is available in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. Users should upgrade to these or later versions to remediate the vulnerability. No additional mitigation guidance is provided or required beyond applying the official patches.