CVE-2026-76322: The software does not perform an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk Enterprise

In affected Splunk Enterprise versions, a user with the "user" role can create a Dashboard Studio dashboard that runs attacker-controlled SPL queries as another authenticated user. This is due to insufficient enforcement of app-visibility authorization boundaries in Dashboard Studio before search queries are dispatched. The attacker must phish the victim to trigger the malicious dashboard execution. The vulnerability allows unauthorized access to data and can affect system integrity and availability.

An attacker with a "user" role can execute arbitrary SPL queries as another authenticated user, potentially accessing sensitive data and impacting system integrity and availability. However, exploitation requires phishing the victim to initiate the malicious request, limiting the attacker's ability to exploit the vulnerability at will.

Upgrade Splunk Enterprise to versions 10.4.2, 10.2.6, 10.0.9, or 9.4.14 or later where this vulnerability is fixed. Since this is a software vulnerability with fixed versions available, applying the official patches is the recommended remediation. No vendor advisory content was provided to indicate otherwise.