The vulnerability arises from unsanitized special characters in the values that Splunk Secure Gateway uses to build filters for dashboard and report listing requests. This flaw allows an attacker who is authenticated with a non‑admin or non‑power role to inject arbitrary SPL expressions into the REST API, causing the system to return dashboards and reports beyond the intended filter scope. The result is the exposure of configuration objects, search queries, and potentially sensitive data that the user should not normally view.

Affected products are Splunk Enterprise (versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16) and Splunk Secure Gateway (versions below 3.10.12, 3.9.26, and 3.8.73). Any installation running one of these product versions without the recommended updates is susceptible.

The CVSS score of 4.3 indicates moderate severity. While the EPSS score is not publicly available and the vulnerability is not listed in the CISA KEV catalog, the flaw can be exploited remotely over the REST API by any authenticated attacker with a basic user role. The attacker needs only the ability to send specially crafted filter parameters, and can therefore bypass role‑based restrictions to view additional dashboards or reports. The attack requires no local privileges or administrative access, making it a practical risk for organizations that rely on role isolation to protect sensitive assets.