CVE-2026-20203

Improper Access Control in Data Model Acceleration in Splunk Enterprise

State: Published
Severity: 4.3 Medium
Published: Apr 15, 2026
Updated: Apr 15, 2026
Reserved: Oct 8, 2025

Description

In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127, a low-privileged user that does not hold the `admin` or `power` Splunk roles, has write permission on the app, and does not hold the high-privilege capability `accelerate_datamodel`, could turn on or off Data Model Acceleration due to improper access control.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	cisco

Weaknesses

CWE-284 The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Affected Products

Product	Versions
Splunk EnterpriseSplunk	10.2 to before 10.2.2Affected 10.0 to before 10.0.5Affected 9.4 to before 9.4.10Affected 9.3 to before 9.3.11Affected
Splunk Cloud PlatformSplunk	10.4.2603 to before Not AffectedAffected 10.3.2512 to before 10.3.2512.6Affected 10.2.2510 to before 10.2.2510.10Affected 10.1.2507 to before 10.1.2507.19Affected 10.0.2503 to before 10.0.2503.13Affected 9.3.2411 to before 9.3.2411.127Affected

References

https://advisory.splunk.com/advisories/SVD-2026-0402

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.