CVE-2026-76292: The software does not perform an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise and Splunk Secure Gateway, the Key Value Store (KV Store) collections used by the Splunk Secure Gateway App do not perform proper user-level authorization checks on read requests. This allows low-privileged users lacking the "admin" or "sc_admin" roles to access mobile alert notification data belonging to other users via the KV Store REST API endpoints. The vulnerability is due to missing enforcement of role-based access control in these specific KV Store collections. The affected versions are prior to 10.4.4, 10.2.8, 10.0.11, and 9.4.16 for Splunk Enterprise, and prior to 3.10.12, 3.9.26, and 3.8.73 for Splunk Secure Gateway. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

An attacker with low privileges can read sensitive mobile alert notification data of other users, leading to unauthorized disclosure of potentially sensitive information. There is no impact on data integrity or availability. The confidentiality impact is high, but the overall severity is medium due to the limited scope of the vulnerability and the requirement for low privileges.

A fix is available in Splunk Enterprise versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions 3.10.12, 3.9.26, and 3.8.73. Users should upgrade to these versions or later to remediate the vulnerability. No other mitigation steps are indicated by the vendor advisory.