Privilege Escalation in Splunk Enterprise Due to Inadequate Permission Handling

CVE-2025-20226

What is CVE-2025-20226?

In certain versions of Splunk Enterprise and Splunk Cloud Platform, a low-privileged user can exploit a flaw that allows them to execute saved searches using risky commands. This vulnerability involves the use of the permissions of higher-privileged users to bypass safeguards implemented on the search endpoint. By tricking a victim into initiating a request in their browser, the attacker can access privileged functionalities without having the necessary roles, such as 'admin' or 'power'. This necessitates social engineering tactics to successfully initiate the attack.

References