This vulnerability stems from a missing authorization check in the REST API endpoints that expose the Splunk Secure Gateway App Key Value Store. A low‑privileged user who lacks the admin or sc_admin roles can exploit the endpoint to read mobile alert notification data belonging to other users. The flaw allows an attacker to gain unauthorized read access to sensitive data without authentication or elevated privileges.

Affected systems include Splunk Enterprise deployments running versions earlier than 10.4.4, 10.2.8, 10.0.11, or 9.4.16, as well as Splunk Secure Gateway versions earlier than 3.10.12, 3.9.26, or 3.8.73. In these configurations, the App Key Value Store collections are exposed via misconfigured REST endpoints, permitting outside actors to retrieve confidential alert information.

The CVSS score of 6.5 denotes medium risk, and the exploit probability is not available, but the vulnerability is not catalogued in CISA's KEV. An attacker only needs an existing low‑privileged account to trigger the predictable API call, making the exploit straightforward and likely to succeed if the system remains unpatched or the Secure Gateway app is active.