CVE-2026-76397: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. in Splunk Splunk AI Toolkit

In Splunk AI Toolkit versions prior to 6.0.0, the authorization mechanism is flawed such that a user with the "power" role can bypass access controls by altering the key identifying experiment data. This allows unauthorized access and deletion of other users' experiment history data. The root cause is the failure to preserve the trusted experiment scope when processing caller-controlled query values before accessing restricted history data.

An attacker with the "power" Splunk role can access and delete experiment history data associated with other users, leading to unauthorized data exposure and potential data loss. The vulnerability affects confidentiality and integrity but not availability.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the assignment of the "power" role to trusted users only and monitor for suspicious activity related to experiment data access.