Privilege escalation via PDF alert context mix-up

Privilege escalation in Splunk Enterprise before 10.4.2, 10.2.6, 10.0.9, and 9.4.14 lets remote authenticated users run arbitrary SPL via PDF alerts. When a scheduled email alert renders a PDF attachment, the search scheduler passes a system-level authentication context to the email alert action instead of the action owner's context, so attacker-controlled searches execute with elevated privileges. Reachability requires a role with the schedule_search capability and permission to configure PDF attachments for email alert actions; successful exploitation can expose all data visible to the system context and alter or disrupt the search head.