A configuration‑related vulnerability allows users who do not hold the "admin" or "power" Splunk roles to create, move, edit, or delete sourcetype renaming configurations that they own in apps they do not have permission to access. This flaw is a missing authorization issue (CWE-862) that can alter how data sources are identified and interpreted during searches, potentially leading to incorrect data processing or schema manipulation.

The flaw exists in Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16 when Splunk Web is enabled. Users without sufficient Splunk roles who have access to the Web UI can exploit the missing permission checks to modify sourcetype renaming settings in applications they cannot normally access.

With a CVSS score of 4.3 the vulnerability is considered moderate. The EPSS score is not available, and the CVE is not listed in CISA's KEV catalog, indicating low to moderate exploitation likelihood. The likely attack vector is via the Splunk Web interface and requires a valid user account with a non‑admin role. Exploitability is limited to configuration changes; it does not grant privilege escalation or arbitrary code execution, but it can compromise data integrity and search results.