A flaw in Splunk Enterprise and Splunk Cloud Platform permits a user who has write permission on an application but does not hold the admin or power roles and lacks the accelerate_datamodel capability to enable or disable Data Model Acceleration. The vulnerability does not provide remote code execution or direct data exfiltration; it simply modifies a configuration setting that may change how the system pre‑computes and stores data for faster searches.

Splunk Enterprise versions older than 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions older than 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127 are affected; all newer releases contain the fix.

The CVSS base score is 4.3, indicating low severity, and no EPSS data is available. The vulnerability is not listed in the KEV catalog. Exploitation requires an authenticated user who already has write access to an application but does not possess the admin or power roles. The attacker can toggle acceleration without granting higher privileges or causing code execution, so the impact is limited to altering search performance characteristics within that Splunk deployment.