CVE-2026-76275: The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk Enterprise

In Splunk Enterprise versions prior to 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a vulnerability exists due to incomplete authorization checks in the REST API that handles search job listings. Users lacking admin or power roles can retrieve search query texts and job metadata belonging to other users, including job identifiers, dispatch parameters, result counts, and execution metadata. This occurs because the API does not fully enforce per-user authorization before including job information in the response.

The vulnerability allows unauthorized users with limited privileges to access sensitive search job information of other users. This exposure is limited to metadata and query text, without impact on data integrity or availability. The CVSS score of 4.3 reflects a low complexity attack with limited confidentiality impact and no integrity or availability impact.

A fix is available in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. Users should upgrade to these or later versions to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.