Access Control Flaw in Splunk Enterprise and Secure Gateway App

CVE-2025-20230

Summary

In specific versions of Splunk Enterprise and the Splunk Secure Gateway app, a vulnerability exists that allows low-privileged users to edit and delete data belonging to other users. The flaw arises from inadequate access control and improper data ownership management within KVStore collections, which results in data being owned by the generic 'nobody' user. This oversight places sensitive user data at risk by allowing unauthorized access and manipulation, undermining the integrity of the application.

References