CVE-2026-76275

Improper Authorization in Search Job Listings through the REST API in Splunk Enterprise

State: Published
Severity: 4.3 Medium
Published: Oct 7, 2026
Updated: Oct 9, 2026
Reserved: Aug 19, 2026

Description

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could access search query text and job metadata for jobs that belong to other users, including job identifiers, dispatch parameters, result counts, and execution metadata, through an Application Programming Interface (API) implemented as a Representational State Transfer (REST) API. The vulnerability is possible because the REST API does not fully enforce per-user authorization before it includes job information in search job listings.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	cisco

Weaknesses

CWE-285 The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Affected Products

Product	Versions
Splunk EnterpriseSplunk	10.4 to before 10.4.3Affected 10.2 to before 10.2.7Affected 10.0 to before 10.0.10Affected 9.4 to before 9.4.15Affected

References

https://advisory.splunk.com/advisories/SVD-2026-1001

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.