The flaw arises because the dispatch archive download path in Splunk Enterprise fails to enforce the embedded‑report authorization boundary, exposing sensitive session data. An unauthenticated user who can view the HTML source of a page that embeds a Splunk report can copy session material and use it to retrieve all data and potentially alter contents associated with the report. The weakness is an improper access control (CWE‑284).

Affected releases are all Splunk Enterprise versions older than 10.4.1, 10.2.6, 10.0.9, and 9.4.14. Deployments that have the Splunk Web interface enabled are at risk because embedded reports rely on the web layer to deliver session material.

The CVSS score of 9.4 classifies this issue as critical, indicating that attackers can achieve high‑impact access without authentication. While an EPSS score is not available and the vulnerability is not listed in CISA KEV, the combination of a high severity score, extensive data exposure, and a documented workaround shows that the risk is substantial. The attack vector is likely through the web interface, where an attacker can simply view the page source to harvest session tokens and subsequently read or modify data within the Splunk environment.