Cross-service access via unchecked token forwarding

Improper authorization in Splunk Enterprise before 10.0.9, 10.2.6, and 10.4.2 allows remote authenticated users to access Splunk Observability Cloud data via the bundled app. The Splunk App for Splunk Observability Cloud exposes REST endpoint handlers that forward caller-selected requests with the app's stored Observability Cloud access token without enforcing the read_o11y_content capability. Exploitation requires a valid Splunk account that lacks the admin or power role, and the consequence is bounded by the data visibility and limited content changes permitted to that stored token.