Splunk Improper Access Control Vulnerability Allows Alert Suppression by Low-Privilege Users

A vulnerability exists in Splunk Enterprise versions prior to 9.4.2, 9.3.5, 9.2.6, and 9.1.9, as well as in Splunk Cloud Platform versions prior to 9.3.2411.103, 9.3.2408.112, and 9.2.2406.119. This vulnerability allows low-privileged users, who do not have 'admin' or 'power' roles and have read-only access to specific alerts, to suppress those alerts when they are triggered.

Impact

Exploitation of this vulnerability allows low-privileged users to suppress alerts they have read-only access to, potentially leading to missed notifications of important events or issues.

Remediation

Users can upgrade to Splunk Enterprise versions 9.4.2, 9.3.5, 9.2.6, 9.1.9 or higher. For Splunk Cloud Platform, no action is needed as Splunk is actively monitoring and patching instances. If using Splunk Web, this component can be disabled as a workaround.