---
id: "CVE-2026-76292"
kind: "vulnerability"
aliases: ["CVE-2026-76292"]
title: "Splunk Enterprise: low-privileged users can read other users' mobile alert data"
severity: "medium"
cvss: 6.5
epss: 0.00264
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "splunk", "splunk-enterprise", "splunk-secure-gateway"]
not_affected_if: ["admin-only-users", "no-secure-gateway-app"]
published_at: "2026-10-21T23:17:27+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:48:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76292", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-76292", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Splunk Enterprise: low-privileged users can read other users' mobile alert data

Splunk Secure Gateway's app key value store collections skip per-user authorization on read requests. A low-privileged Splunk user can read mobile alert notification data belonging to other users through the KV Store REST endpoints.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Splunk Enterprise version with `splunk version` and compare it to the fixed releases listed in the fix field.
- Check the Splunk Secure Gateway app version in Splunk Web under Apps > Manage Apps, or in the app's `app.conf`.
- Confirm whether the Splunk Secure Gateway app is installed and used for mobile alerts.

## Fix

- Upgrade Splunk Enterprise to `10.4.4`, `10.2.8`, `10.0.11`, or `9.4.16`, matching your release line.
- Upgrade Splunk Secure Gateway to `3.10.12`, `3.9.26`, or `3.8.73`, matching your release line.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76292
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-76292

## From the sources

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a low-privileged user that does not hold the "admin" Splunk role or the "sc_admin" Splunk Secure Gateway role could read mobile alert notification data for other users through Splunk Secure Gateway App Key Value Store (KV Store) Representational State Transfer (REST) API endpoints.
The vulnerability is possible because the affected Splunk Secure Gateway App Key Value Store collections do not enforce user-level authorization for read requests.
For more information see About the app key value store (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.2/administer-the-app-key-value-store/about-the-app-key-value-store) and About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access) in the Splunk documentation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_