---
id: "CVE-2026-76296"
kind: "vulnerability"
aliases: ["CVE-2026-76296"]
title: "Splunk Enterprise: low-privilege users can change sourcetype renames in restricted apps"
severity: "medium"
cvss: 4.3
epss: 0.00205
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["self-hosted", "splunk-enterprise", "vendor"]
not_affected_if: ["fixed-version", "splunk-web-disabled"]
published_at: "2026-10-21T23:17:27+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T04:37:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76296", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-76296", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Splunk Enterprise: low-privilege users can change sourcetype renames in restricted apps

A Splunk Enterprise user without the admin or power role can create, move, edit, or delete sourcetype renaming configurations in apps they lack access to. The flaw exists because Splunk Web does not check app permissions before these operations run.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Splunk Enterprise version with `splunk version` and compare it against the fixed releases.
- Confirm whether Splunk Web is enabled on the instance (unknown whether the sources give a specific command).

## Fix

- Upgrade Splunk Enterprise to `10.4.4`, `10.2.8`, `10.0.11`, or `9.4.16`, matching the release line in use.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76296
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-76296

## From the sources

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move, edit, or delete sourcetype renaming configurations that they own in apps that they do not have permission to access.
The vulnerability is possible when Splunk Web is turned on because Splunk Web does not verify the required app permissions before it performs sourcetype renaming operations.
For more information see Rename source types at search time (https://help.splunk.com/en/splunk-enterprise/get-started/get-data-in/10.6/configure-source-types/rename-source-types-at-search-time) in the Splunk documentation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_