In Splunk Enterprise, a privilege‑escalation flaw allows users who lack the admin or power roles to create or modify scripted lookups via generic REST‑API configuration endpoints. The vulnerability enables the attacker to run installed lookup scripts under the Splunk service user, giving them access to all indexed data and the ability to alter system integrity and availability. The weakness is an authorization bypass (CWE‑285).

Splunk Enterprise versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14 are impacted. All installations using those releases are at risk.

The CVSS score of 8.8 indicates high severity. With no EPSS score available and the vulnerability not listed in KEV, the exploitation likelihood is unknown, but the web‑based REST API attack path is straightforward for an authenticated user. Attackers only need to log into Splunk with an account that does not have admin or power roles, then issue configuration commands to add or modify a scripted lookup and trigger the lookup script. This grants them persistent privileged access and can compromise data confidentiality, integrity, and availability.