In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated attacker possessing an embedded report token can exploit insufficient access restrictions to download the search job dispatch archive via REST API. This archive contains session material that can be used to access all data accessible to the report owner, including performing administrative actions if the owner holds the admin role. The vulnerability stems from embedded report access not blocking REST API dispatch archive download requests, leading to unauthorized data access and potential system integrity compromise.

An unauthenticated attacker can gain unauthorized access to sensitive data and system functions by leveraging embedded report tokens to download search job dispatch archives. This can lead to full data exposure available to the report owner and administrative control if the owner has admin privileges, severely impacting confidentiality, integrity, and availability of the Splunk Enterprise system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or disable embedded report tokens and carefully configure role-based access controls to limit exposure. Review Splunk documentation on additional configuration for embedded reports and role-based user access to mitigate risk.