CVE-2026-20203: Improper Access Control in Data Model Acceleration in Splunk Enterprise

Q: What is the severity of CVE-2026-20203?

CVE-2026-20203 is rated as low severity due to its potential for improper access control affecting low-privileged users.

Q: How do I fix CVE-2026-20203?

To mitigate CVE-2026-20203, upgrade Splunk Enterprise to versions 10.2.2 or later, or Splunk Cloud Platform to versions 10.4.2603.0 or later.

Q: Which versions of Splunk are affected by CVE-2026-20203?

CVE-2026-20203 affects Splunk Enterprise versions below 10.2.2 and 10.0.5, as well as Splunk Cloud Platform versions below 10.4.2603.0.

Q: What types of users are impacted by CVE-2026-20203?

CVE-2026-20203 allows low-privileged users to gain unauthorized access to certain data.

Q: Is CVE-2026-20203 specific to any deployment type of Splunk?

Yes, CVE-2026-20203 affects both Splunk Enterprise and Splunk Cloud Platform deployments.

Published Apr 15, 2026

Updated

In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2507.19, 10.0.2503.13, and 9.3.2411.127, a low-privileged user that does not hold the `admin` or `power` Splunk roles, has write permission on the app, and does not hold the high-privilege capability `accelerate_datamodel`, could turn on or off Data Model Acceleration due to improper access control.

Affected Software

11 affected components

Splunk Splunk Enterprise<10.2.2, <10.0.5, <9.4.10, <9.3.11

Splunk Splunk Cloud Platform<10.4.2603.0, <10.3.2512.6, <10.2.2510.10, <10.1.2507.19, <10.0.2503.13, <9.3.2411.127

Splunk splunk>=9.3.0<9.3.11

Splunk splunk>=9.4.0<9.4.10

Splunk splunk>=10.0.0<10.0.5

Splunk splunk>=10.2.0<10.2.2

Splunk Splunk Cloud Platform>=9.3.2411<9.3.2411.127

Splunk Splunk Cloud Platform>=10.0.2503<10.0.2503.13

Splunk Splunk Cloud Platform>=10.1.2507<10.1.2507.19

Splunk Splunk Cloud Platform>=10.2.2510<10.2.2510.10

Splunk Splunk Cloud Platform>=10.3.2512<10.3.2512.6

Event History

Apr 15, 2026

CVE Published

via MITRE·03:17 PM

Data Sourced

via MITRE·03:17 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-20203?

CVE-2026-20203 is rated as low severity due to its potential for improper access control affecting low-privileged users.

How do I fix CVE-2026-20203?

To mitigate CVE-2026-20203, upgrade Splunk Enterprise to versions 10.2.2 or later, or Splunk Cloud Platform to versions 10.4.2603.0 or later.

Which versions of Splunk are affected by CVE-2026-20203?

CVE-2026-20203 affects Splunk Enterprise versions below 10.2.2 and 10.0.5, as well as Splunk Cloud Platform versions below 10.4.2603.0.

What types of users are impacted by CVE-2026-20203?

CVE-2026-20203 allows low-privileged users to gain unauthorized access to certain data.

Is CVE-2026-20203 specific to any deployment type of Splunk?