CVE-2026-76398: The software does not perform an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk AI Toolkit

In Splunk AI Toolkit versions >=6.0 and <6.0.1, a lack of proper authorization checks in the REST API allows users without 'admin' or 'power' roles to delete experiment history belonging to other users. The vulnerability exists because the software deletes experiment history prior to verifying that the requesting user has permission to delete the associated experiment. This can lead to unauthorized modification of experiment data.

The vulnerability allows unauthorized users with limited privileges to delete experiment history of other users, resulting in integrity loss of experiment data. There is no confidentiality or availability impact reported. The CVSS score is 4.3 (medium severity) reflecting limited impact on integrity only.

No patch or official fix information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the REST API and ensure only trusted users have roles that allow experiment deletion.