Listen to this Post
How the CVE works:
In vulnerable versions of Splunk Enterprise and Splunk Secure Gateway app, a low-privileged user without “admin” or “power” roles can subscribe to mobile push notifications. The notification system is designed to alert users about reports or alerts. However, when a report or alert is triggered, the system sends push notifications to subscribed users. This process does not properly verify if the user has view permissions for the specific report or alert. Consequently, the notification includes the and description of the report or alert. This data is disclosed even if the user lacks access rights to view the underlying content. The vulnerability stems from insufficient access controls in the notification dissemination code. It affects Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10. It also affects Splunk Secure Gateway app versions below 3.9.10, 3.8.58, and 3.7.28 on Splunk Cloud Platform. The flaw allows authenticated users to exploit the notification subscription feature. No additional privileges are required beyond having a user account. The attack can be performed remotely over the network. User interaction is not needed for the disclosure to occur. The vulnerability has a CVSS base score of 4.3, indicating medium severity. It impacts confidentiality by leaking sensitive information. Integrity and availability are not affected. Patches address this by enforcing role-based access checks before sending notifications. Fixed versions ensure that only users with appropriate permissions receive detailed notification data.
Platform: Splunk Enterprise
Version: Multiple vulnerable versions
Vulnerability: Information disclosure vulnerability
Severity: Medium
Date: 12/03/2025
Prediction: Patch December 2025
What Undercode Say:
Analytics:
Check Splunk version
splunk version
List notification subscriptions
splunk search “index=_internal NOTIFICATION” | table user, object
Verify app versions
splunk display app
How Exploit:
Subscribe to notifications.
Trigger alert events.
Capture disclosed data.
Protection from this CVE:
Upgrade to fixed versions.
Restrict notification subscriptions.
Apply access control reviews.
Impact:
Unauthorized information disclosure.
Sensitive data exposure.
Compliance violation risks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
