An unauthenticated user who obtains an embedded report token can download the search job dispatch archive associated with that token. The archive contains session data that allows the attacker to read all data the report owner can access and, if the owner holds the admin role, to perform administrative actions. The flaw arises because embedded report access does not block REST‑API requests for the dispatch archive.

Splunk Enterprise versions older than 10.4.2, 10.2.6, 10.0.9, and 9.4.14 are vulnerable. All installations of Splunk Enterprise that have not been patched to one of these releases or a later version are affected.

The CVSS score of 9.4 indicates a high‑severity vulnerability, and the EPSS score is not available, suggesting limited current data on exploitation frequency. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a web‑based REST‑API call; an attacker must first obtain or guess an embedded report token, which may be exposed through misconfiguration or insider misuse. Once the token is in hand, the attacker can retrieve the dispatch archive, recover session material, and potentially gain administrative privileges if the original report owner is an admin.