In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated attacker who can view the HTML source of a page embedding a Splunk report may extract sensitive session material from the dispatch archive download path. This path does not correctly enforce authorization boundaries for embedded reports, allowing the attacker to access all relevant data and potentially affect system integrity. The vulnerability arises because archived search-job data includes sensitive session information that should be protected. The issue is documented in Splunk's guidance on additional configuration for embedded reports and embedding scheduled reports.

The vulnerability allows unauthenticated attackers to bypass authorization controls and access sensitive data within Splunk Enterprise. This can lead to a complete compromise of confidentiality and integrity of the affected system's data. The CVSS score of 9.4 reflects the high severity and ease of exploitation without any privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and apply Splunk's recommended configurations for embedded reports as described in their documentation to limit exposure of session material. Monitor Splunk's official channels for updates and patches addressing this vulnerability.