A low‑privileged user who is not an admin or power role can create a malicious classic dashboard that contains a CSS injection. When a higher‑privileged administrator views the dashboard, the injected CSS triggers an outbound request to an external server, allowing credentials or other sensitive information to be exfiltrated. The flaw is due to inadequate validation of inline style attributes, a weakness identified as CWE‑20, and results in unauthorized information disclosure rather than code execution.

The vulnerability affects Splunk Enterprise releases prior to 10.2.4, 10.0.7, 9.4.12, and 9.3.13, as well as Splunk Cloud Platform releases prior to 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132. Users of the Splunk Cloud Platform and Splunk Enterprise environments should verify their version numbers against these thresholds.

The CVSS score of 5.7 indicates medium severity. Because the EPSS score is unavailable, the historical likelihood of exploitation is unclear, and the vulnerability is not listed in the CISA KEV catalog, the current risk exposure depends largely on whether a controller with higher privileges is likely to view dashboards created by low‑privileged users. The attack vector is inferred to require a crafted dashboard that a privileged user subsequently opens, making exploitation easier in environments where dashboard creation is not tightly controlled.