The flaw allows a non‑admin or power user to relocate field extractions or transformations to an app they cannot read using the REST API, as the API fails to check destination app permissions before processing the move command. The attacker can exploit this to take control of field objects that belong to other apps.

Splunk Enterprise users running any of the affected versions—10.4.x prior to 10.4.4, 10.2.x before 10.2.8, 10.0.x before 10.0.11, or 9.4.x before 9.4.16—are impacted. No other vendors or products are listed.

With a CVSS score of 4.3 the vulnerability is rated moderate, and no EPSS data or KEV listing is available, indicating no evidence of widespread exploitation. The attack requires authentication and an active REST API session, and the likely vector is a network attacker who can authenticate to Splunk. The inability to validate destination app access gives the attacker potential to grant themselves or others read rights to data that should remain restricted, which could lead to indirect data disclosure or manipulation of search results.