CVE-2026-76322: The software does not perform an authorization check when an actor attempts to access a resource or perform an action. in Splunk Splunk Enterprise

CVE-2026-76322 affects Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A user with the "user" role can create a Dashboard Studio dashboard that runs attacker-controlled SPL queries as another authenticated user. This is possible because Dashboard Studio does not consistently enforce app-visibility authorization boundaries before search queries reach the search dispatch layer. The vulnerability requires user interaction via phishing to trigger the malicious dashboard execution. The attacker-controlled SPL can access all relevant data and potentially affect system integrity and availability.

An attacker with the "user" role can cause another authenticated user to execute SPL queries controlled by the attacker, potentially accessing sensitive data and impacting system integrity and availability. The vulnerability requires user interaction (phishing) and cannot be exploited at will by the attacker. The CVSS 3.1 score is 6.7 (medium severity), reflecting network attack vector, high complexity, low privileges required, user interaction needed, and high impact on confidentiality and integrity with low impact on availability.

Splunk has released fixed versions 10.4.2, 10.2.6, 10.0.9, and 9.4.14 that address this vulnerability. Users should upgrade to one of these versions or later to remediate the issue. There is no indication that the vulnerability is mitigated by default or that no action is required. Until patched, organizations should be cautious of phishing attempts that could trigger this vulnerability.