CVE-2026-76278: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. in Splunk Splunk Enterprise

In Splunk Enterprise versions >=10.0 <10.0.10, >=10.2 <10.2.7, and >=10.4 <10.4.3, a user holding a role with the edit_spl2_module_permissions capability can exploit a flaw in the REST API that returns SPL2 module permission grants without verifying if the user has read access to the requested app. This improper authorization allows unauthorized access to permission grants for SPL2 modules. The vulnerability does not affect version 9.4.x and has a CVSS 3.1 base score of 4.3 (medium severity).

The vulnerability enables unauthorized users with the specific capability to view permission grants for SPL2 modules they should not have access to. This could lead to information disclosure about module permissions but does not allow modification or denial of service. There is no indication of active exploitation in the wild.

A fix is available in Splunk Enterprise versions 10.0.10, 10.2.7, and 10.4.3. Users should upgrade to these or later versions to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.