Splunk Enterprise and Cloud Platform
CVE-2023-32707: ‘edit_user’ Capability Privilege Escalation
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted web requests.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Splunk Enterprise 8.1 | 8.1.14 or later |
| Splunk Enterprise 8.2 | 8.2.11 or later |
| Splunk Enterprise 9.0 | 9.0.5 or later |
| Splunk Cloud Platform - | 9.0.2303.100 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admin user by providing specially crafted web requests.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.