# CVE-2026-20259: Splunk Enterprise improper access control in saved search ownership

Source: https://junglewise.ai/threats/cve-2026-20259-splunk-enterprise-improper-access-control-in-saved-search  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-20259 · Severity: medium · CVSS 5.5 · Published 2026-06-10

Splunk Enterprise and Splunk Cloud Platform are data analysis platforms used for monitoring and searching machine-generated data. A security flaw in the web interface allows high-privileged users to reassign the ownership of saved searches to users outside of their authorized scope. This could lead to unauthorized access to sensitive search results or reports by users who should not have permission to view them.

Technologies: [Splunk Cloud Platform](https://junglewise.ai/threats/technologies/cloud-platform). Vendors: [Splunk](https://junglewise.ai/threats/vendors/splunk).

## Quick answers

**Is CVE-2026-20259 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20259 being exploited in the wild.

**How severe is CVE-2026-20259?** Medium severity, with a CVSS score of 5.5, published 10 June 2026.

**Which products and versions are affected?** Splunk Cloud Platform Below 10.4.2604.0, 10.3.2512.12, 10.2.2510.15, 10.1.2507.23, 10.0.2503.14, 9.3.2411.131.

**Is there a fix for CVE-2026-20259?** A patch was published on 2026-06-10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-20259 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-20259?** Check whether you run Splunk Cloud Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper access control vulnerability (CWE-284) exists in the Splunk Web component of Splunk Enterprise and Splunk Cloud Platform. The vulnerability resides in the ownership reassignment endpoint, which fails to properly validate the scope of the target user. An attacker with a role containing the 'edit_saved_search_owner' capability can exploit this to reassign saved searches to users outside their authorized administrative scope. This can lead to unauthorized data exposure if the new owner gains access to search results they were previously restricted from viewing. The issue is resolved in Splunk Enterprise versions 10.4.0, 10.2.4, 10.0.7, and various Splunk Cloud Platform maintenance releases.

## Affected products

- Splunk Splunk Enterprise 10.2.0 to 10.2.3, 10.0.0 to 10.0.6
- Splunk Splunk Cloud Platform Below 10.4.2604.0, 10.3.2512.12, 10.2.2510.15, 10.1.2507.23, 10.0.2503.14, 9.3.2411.131

## Timeline

- 2026-06-10: disclosed
- 2026-06-10: patched
- 2026-06-10: advisory

## References

- [https://advisory.splunk.com/advisories/SVD-2026-0609](https://advisory.splunk.com/advisories/SVD-2026-0609)

## Related threats

- [Splunk Enterprise and Cloud Platform information disclosure in REST API](https://junglewise.ai/threats/cve-2026-20298-splunk-enterprise-and-cloud-platform-information-disclosure-in)
- [Splunk Enterprise path traversal in App Install REST endpoint](https://junglewise.ai/threats/cve-2026-20297-splunk-enterprise-path-traversal-in-app-install-rest-endpoint)
- [Splunk Enterprise stored XSS in classic dashboard HTML panel](https://junglewise.ai/threats/cve-2026-20258-splunk-enterprise-stored-xss-in-classic-dashboard-html-panel)
- [Splunk Enterprise and Cloud Platform Data Exfiltration in Classic Dashboards](https://junglewise.ai/threats/cve-2026-20257-splunk-enterprise-and-cloud-platform-data-exfiltration-in-classic)
- [Splunk Enterprise and Cloud Platform data exfiltration in Classic Dashboards](https://junglewise.ai/threats/cve-2026-20256-splunk-enterprise-and-cloud-platform-data-exfiltration-in-classic)