Splunk Enterprise CVE-2026-20259

Exploitation requires the attacker to be authenticated to the Splunk instance and to hold a Splunk role that explicitly grants the edit_saved_search_owner capability, which Splunk classifies as a high-privilege capability - this is confirmed by the CVSS PR:H designation. The attacker must have network-level access to the Splunk REST API endpoint (AV:N). Exploitation is limited by: (1) the mandatory high-privilege role requirement, restricting exploitable accounts to a small subset of users who have been explicitly granted this capability; (2) the absence of any scope-change (S:U), meaning impact is contained within the Splunk instance rather than affecting broader system resources. There is no requirement for user interaction (UI:N) and attack complexity is low (AC:L) once the privilege threshold is satisfied.

The CVSS score of 5.5 (Medium) accurately reflects the constrained exploitability: the PR:H requirement means only users already holding a Splunk role with the edit_saved_search_owner capability can exploit this, significantly narrowing the threat actor pool to insiders or accounts already compromised at a high-privilege level. The C:H confidentiality impact is notable - saved searches in Splunk frequently contain embedded credentials, sensitive queries, and data access patterns, making unauthorized ownership reassignment a meaningful data exposure vector. The I:L integrity impact reflects the ability to alter ownership metadata. No EPSS data was provided in the source intelligence, and this CVE is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The 'Authentication Bypass' tag applied to this CVE refers to the authorization scope bypass rather than a full authentication bypass - the CVSS PR:H vector confirms authentication is still required, and defenders should not interpret the tag as indicating unauthenticated exploitability. Overall, this is a real but operationally limited risk, most relevant to organizations with multiple Splunk roles delegating the edit_saved_search_owner capability across semi-trusted users.

An authenticated Splunk user whose role includes the edit_saved_search_owner capability crafts an API request to the ownership reassignment endpoint, specifying a target saved search and a destination user account outside their authorized management scope. The endpoint processes the request without validating scope boundaries, transferring ownership to the unauthorized user, who can then access the saved search - including any embedded credentials, data source queries, or sensitive alert logic contained within it. No public exploit has been identified at time of analysis, but the low attack complexity (AC:L) means that any actor with the required privilege can trivially attempt exploitation with standard HTTP tooling against the Splunk REST API.