Privilege Escalation Vulnerability in Splunk Enterprise and Cloud Platform

CVE-2025-20232

What is CVE-2025-20232?

In certain versions of Splunk Enterprise and Splunk Cloud Platform, a low-privileged user can exploit a vulnerability to execute saved searches with risky commands, utilizing the permissions of higher-privileged roles. This issue arises in scenarios where an attacker successfully deceives an authenticated user into executing a malicious request through their browser. The vulnerability highlights potential bypassing of secure command mechanisms at the '/app/search/search' endpoint, posing security risks to Splunk environments.

References