The vulnerability arises from improper access control within the Splunk Monitoring Console App bundled with Splunk Enterprise. The flaw allows a low‑privileged, non‑admin Splunk user to access endpoints that should be restricted, thereby exposing sensitive information that would normally be protected by role‑based permissions. This weakness is identified in the CVE as CWE‑200, a data‑exposure vulnerability.

Splunk Enterprise versions older than 10.0.2, 10.0.3, 9.4.8, and 9.3.9 are affected. The Monitoring Console App is included with on‑premises installations and is not available through SplunkBase nor installed on Splunk Cloud Platform instances, so the vulnerability does not impact cloud deployments.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score of less than 1% shows a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. It is likely to be exploited by an authenticated local user who possesses a Splunk account but lacks the admin role; no remote execution or privilege escalation is possible based on the available data.