The vulnerability allows a user who holds the standard "user" Splunk role to craft a Dashboard Studio dashboard that injects arbitrary Search Processing Language (SPL) queries. This injects attacker‑controlled SPL to run against the index, giving the attacker access to all data and enabling changes that can compromise system integrity and availability. The flaw is rooted in a missing authorization check (CWE‑862).

Splunk Enterprise users running versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14 are affected. The issue is tied to the Dashboard Studio component, which mis‑enforces the app‑visibility authorization boundary before passing search query options to the search dispatch service.

The CVSS score of 6.7 classifies the vulnerability as moderate. EPSS data is not available and the issue is not listed in the CISA KEV catalog. Exploitation requires attacker‑controlled phishing of a legitimate Splunk user, who must have Splunk Web enabled and navigate to a crafted dashboard. Once the victim’s browser renders the dashboard, the attacker’s SPL executes with the victim’s privileges, potentially exposing confidential data and impacting system integrity or availability. The risk is significant for organizations that grant the "user" role to accounts with access to Dashboards.