Authenticated email impersonation via unrestricted sendemail endpoint

Improper authorization in Splunk Web allows remote authenticated users to send email as affected Splunk Enterprise and Cloud instances. The sendemail REST endpoint accepts requests from any authenticated account instead of restricting access to the local splunk-system-user account. Low-privileged authenticated access is sufficient to originate messages under the instance identity; no confidentiality loss or service interruption is reported.