CVE-2026-76352: The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk Enterprise

In affected versions of Splunk Enterprise, the generic transforms configuration endpoints do not enforce proper capability checks, allowing users lacking admin or power roles to create or edit external lookup definitions. This enables such users to run installed lookup scripts with the privileges of the Splunk Enterprise service account, which could lead to unauthorized access to sensitive data and impact system integrity and availability. The issue arises from insufficient enforcement of role-based access controls on configuration endpoints related to scripted lookups.

An attacker with a non-admin, non-power user account can escalate privileges by creating or modifying scripted lookups, executing code with the permissions of the Splunk Enterprise service account. This can result in unauthorized access to all relevant data and compromise system integrity and availability. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to prevent unauthorized users from accessing or modifying scripted lookups. Review and tighten role capabilities related to configuration endpoints as described in Splunk's documentation on defining roles and limits.conf.