CVE-2026-20259

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.2.4 Splunk Enterprise versions prior to 10.0.7 Splunk Cloud Platform versions prior to 10.4.2604.0 Splunk Cloud Platform versions prior to 10.3.2512.12 Splunk Cloud Platform versions prior to 10.2.2510.15 Splunk Cloud Platform versions prior to 10.1.2507.23 Splunk Cloud Platform versions prior to 10.0.2503.14 Splunk Cloud Platform versions prior to 9.3.2411.131

Description A user with a role containing the high-privilege capability edit saved search owner can reassign saved search ownership to users outside their authorized scope because the ownership reassignment endpoint lacks proper access control.

Recommendations Update to version 10.2.4 or later. Update to version 10.0.7 or later. Update to version 10.4.2604.0 or later. Update to version 10.3.2512.12 or later. Update to version 10.2.2510.15 or later. Update to version 10.1.2507.23 or later. Update to version 10.0.2503.14 or later. Update to version 9.3.2411.131 or later. Restrict the use of the edit saved search owner capability to minimize the risk of unauthorized ownership reassignment.