In affected versions of Splunk Enterprise, the embedded report authorization flow does not properly restrict download requests for dispatch archives before data transmission begins. An unauthenticated attacker possessing an embedded report token can exploit this to download the dispatch archive of an embedded report search job. This allows access to session material and all relevant data associated with the report, potentially compromising confidentiality and integrity of the Splunk platform instance.

The vulnerability enables unauthenticated attackers to access sensitive data by downloading dispatch archives without proper authorization. This compromises confidentiality and integrity of data within the Splunk Enterprise instance. The CVSS score of 9.4 indicates a critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality and integrity with low impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and apply any recommended configuration changes from Splunk documentation regarding embedded reports and report management to limit exposure. Monitor vendor channels for updates and apply patches promptly once released.