CVE-2026-76296: The software does not perform an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise, the software fails to verify app permissions when users attempt to perform sourcetype renaming operations via Splunk Web. This lack of authorization checks allows users without 'admin' or 'power' roles to manipulate sourcetype renaming configurations in apps they should not access. The issue arises specifically when Splunk Web is enabled, as it does not enforce the required app permissions for these operations.

The vulnerability allows users with limited privileges (non-admin, non-power roles) to modify sourcetype renaming configurations in unauthorized apps. This can lead to integrity issues where sourcetype data is incorrectly renamed, potentially affecting data processing and search results. There is no direct confidentiality or availability impact reported.

A fix is available in Splunk Enterprise versions 10.4.4, 10.2.8, 10.0.11, and 9.4.16. Users should upgrade to these or later versions to remediate the vulnerability. Until patched, restricting access to Splunk Web or limiting user roles to trusted users may reduce exposure.