The Splunk AI Toolkit app, in versions below 5.7.3, contains a configuration that modifies the built‑in ‘user’ role using a ‘srchFilter’ entry. Because the Splunk platform concatenates inherited search filters with the OR operator in SPL, the injected filter can override more restrictive child‑role filters, allowing a low‑privileged user to view data intended for higher‑privileged roles. This flaw is an instance of improper access control, classified as CWE‑863, and results in potential confidentiality exposure.

Splunk AI Toolkit for Splunk, versions older than 5.7.3. The issue affects any Splunk deployment that has the app installed with custom roles configured via srchFilter.

The CVSS score of 6.5 indicates a moderate severity, and no EPSS score is reported. The vulnerability is not listed in the CISA KEV catalog. Attackers would need a low‑privileged account within the Splunk environment; the vulnerability is exploitable by interacting with the app from inside the platform, as the flaw relies on configuration inheritance and does not require external network access. An attacker with such an account can effectively bypass restrictions and access confidential data.