CVE-2026-76352: The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise, the generic transforms configuration endpoints do not enforce proper capability checks required to create or edit external lookup definitions. As a result, users lacking admin or power roles can create or modify scripted lookups and run these scripts with the permissions of the Splunk Enterprise user account. This vulnerability allows unauthorized access to all relevant data and can compromise system integrity and availability. The issue arises from incorrect or missing authorization checks on configuration endpoints related to scripted lookups.

An attacker with a non-admin, non-power role can exploit this vulnerability to execute arbitrary lookup scripts with elevated permissions, potentially accessing sensitive data and affecting system integrity and availability. The vulnerability has a CVSS 3.1 score of 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

A fix is available in Splunk Enterprise versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14. Users should upgrade to these or later versions to remediate the vulnerability. The vendor advisory references role capability definitions and configuration file settings that govern permissions for scripted lookups. Applying the official patches and reviewing role capabilities to ensure least privilege is recommended.