CVE-2026-76294: The software does not perform an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise, the REST API responsible for moving field extractions and field transformations fails to validate whether the user has access rights to the destination app. As a result, users with roles other than 'admin' or 'power' can move these knowledge objects to apps they normally cannot access, bypassing intended access controls. This issue affects versions >=9.4 and <9.4.16, >=10.0 and <10.0.11, >=10.2 and <10.2.8, and >=10.4 and <10.4.4.

The vulnerability allows unauthorized users with limited privileges to move field extractions or transformations into apps without having read access to those apps. This could lead to unauthorized modification or reorganization of knowledge objects, potentially impacting data integrity or operational configurations. There is no direct confidentiality or availability impact reported.

A fix is available in Splunk Enterprise versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16 and later. Users should upgrade to these versions to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.