In Splunk Enterprise versions prior to 10.4.1, 10.2.6, 10.0.8, and 9.4.13, a user lacking admin or power roles can cause another user to run arbitrary Search Processing Language commands through the Data Model Editor. The commands are executed with the privileges of the requesting user and can read or modify all data they are authorized to access, thereby compromising system integrity. This weakness stems from the absence of SPL safeguards for risky commands when the editor performs base searches for auto-extracted fields, representing an improper authorization flaw (CWE‑862).

Splunk Enterprise, including the Data Model Editor component, is affected. Any installation using Splunk Web with versions below 10.4.1, 10.2.6, 10.0.8, or 9.4.13, where non‑admin or non‑power users are present, is vulnerable. The issue does not affect installations that have already applied the recommended updates or have Splunk Web disabled.

The CVSS score of 6.4 indicates moderate severity, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not an actively exploited vulnerability. However, exploitation requires the attacker to phish a non‑privileged user into initiating a request from their browser while Splunk Web is enabled, making the attack vector social engineering. Once executed, the adversary can run any SPL command allowed by the victim’s permissions, potentially leaking or altering sensitive information. Due to the social‑engineering prerequisite and the restriction to non‑admin roles, the likelihood of successful exploitation is limited but remains significant in environments with vulnerable configurations.