{"cve":"CVE-2026-76398","nvd":{"published":"2026-08-19T22:17:26.400","modified":"2026-08-24T19:24:02.817","status":"Analyzed","description":"In Splunk AI Toolkit versions below 6.0.1, a user who does not hold the \"admin\" or \"power\" Splunk roles could delete the experiment history of another user without permission through the Representational State Transfer (REST) API. The vulnerability is possible because Splunk AI Toolkit deletes experiment history before it verifies that the user can delete the associated experiment. For more information see Experiment Assistants (https://help.splunk.com/en/splunk-cloud-platform/apply-machine-learning/use-ai-toolkit/5.6.4/experiment-assistants) in the Splunk documentation.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","score":4.3},"cwes":["CWE-862"],"references":["https://advisory.splunk.com/advisories/SVD-2026-0808"],"products":["splunk:ai_toolkit"],"source":"nvd","synced_at":"2026-10-19T22:49:38.260478770+00:00"},"epss":{"cve":"CVE-2026-76398","score":0.00254,"percentile":0.17028,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}