CVE-2026-20203
Full vulnerability record from the local CVENow database.
Description
In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127, a low-privileged user that does not hold the `admin` or `power` Splunk roles, has write permission on the app, and does not hold the high-privilege capability `accelerate_datamodel`, could turn on or off Data Model Acceleration due to improper access control.
Severity
MEDIUM
CVSS score
4.3
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-15 16:16:34.310000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-20203",
"sourceIdentifier": "[email protected]",
"published": "2026-04-15T16:16:34.310",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127, a low-privileged user that does not hold the `admin` or `power` Splunk roles, has write permission on the app, and does not hold the high-privilege capability `accelerate_datamodel`, could turn on or off Data Model Acceleration due to improper access control."
},
{
"lang": "es",
"value": "En las versiones de Splunk Enterprise anteriores a 10.2.2, 10.0.5, 9.4.10 y 9.3.11, y en las versiones de Splunk Cloud Platform anteriores a 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2507.19, 10.0.2503.13 y 9.3.2411.127, un usuario con privilegios bajos que no posee los roles de Splunk ’admin’ o ’power’, tiene permiso de escritura en la aplicación y no posee la capacidad de alto privilegio ’accelerate_datamodel’, podría activar o desactivar la aceleración del modelo de datos debido a un control de acceso inadecuado."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Splunk",
"product": "Splunk Enterprise",
"versions": [
{
"version": "10.2",
"lessThan": "10.2.2",
"versionType": "custom",
"status": "affected"
},
{
"version": "10.0",
"lessThan": "10.0.5",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.4",
"lessThan": "9.4.10",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.3",
"lessThan": "9.3.11",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Splunk",
"product": "Splunk Cloud Platform",
"versions": [
{
"version": "10.4.2603",
"lessThan": "Not Affected",
"versionType": "custom",
"status": "affected"
},
{
"version": "10.3.2512",
"lessThan": "10.3.2512.6",
"versionType": "custom",
"status": "affected"
},
{
"version": "10.2.2510",
"lessThan": "10.2.2510.10",
"versionType": "custom",
"status": "affected"
},
{
"version": "10.1.2507",
"lessThan": "10.1.2507.19",
"versionType": "custom",
"status": "affected"
},
{
"version": "10.0.2503",
"lessThan": "10.0.2503.13",
"versionType": "custom",
"status": "affected"
},
{
"version": "9.3.2411",
"lessThan": "9.3.2411.127",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-15T17:40:22.461732Z",
"id": "CVE-2026-20203",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-284"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "9.3.0",
"versionEndExcluding": "9.3.11",
"matchCriteriaId": "9A537203-F31B-44A1-BB9E-C62F4539FA0B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "9.4.0",
"versionEndExcluding": "9.4.10",
"matchCriteriaId": "0205D102-93C7-42FA-A33E-E517BB7760C4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "10.0.0",
"versionEndExcluding": "10.0.5",
"matchCriteriaId": "D5A01879-50A5-4266-A08C-F55584F442ED"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*",
"versionStartIncluding": "10.2.0",
"versionEndExcluding": "10.2.2",
"matchCriteriaId": "9F3A147D-2A67-469A-A223-248DEFB413E0"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "9.3.2411",
"versionEndExcluding": "9.3.2411.127",
"matchCriteriaId": "6FCB2A3C-8069-4AAC-8746-4B9679DE8116"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "10.0.2503",
"versionEndExcluding": "10.0.2503.13",
"matchCriteriaId": "D5C098C2-9ED5-41B4-BE57-984B71027144"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "10.1.2507",
"versionEndExcluding": "10.1.2507.19",
"matchCriteriaId": "2490F8A7-7B04-4E40-9414-02C050DAEB10"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "10.2.2510",
"versionEndExcluding": "10.2.2510.10",
"matchCriteriaId": "601A4BEC-6F0D-4A52-8B68-18902574E84C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:splunk:splunk_cloud_platform:*:*:*:*:*:*:*:*",
"versionStartIncluding": "10.3.2512",
"versionEndExcluding": "10.3.2512.6",
"matchCriteriaId": "29253EBC-0E89-46ED-B504-E81F5D4E7E3F"
}
]
}
]
}
],
"references": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2026-0402",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}