IdentityIQ Role Editor Incorrect Authorization Vulnerability
Priority LOW 39CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-863.
Summary
This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definition of a role without having an assigned capability that would allow role editing.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00163 5th percentileScored 2026-11-07
Fix Fixed IdentityIQ (SailPoint Technologies): 8.5p2, 8.4p4, 8.3p5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SailPoint | IdentityIQ | 8.5 to before 8.5p2; 8.4 to before 8.4p4; 8.3 to before 8.3p5 | 8.5p2, 8.4p4, 8.3p5 | Patch available | CNA |
- IdentityIQ VendorSailPoint Affected 8.5 to before 8.5p2; 8.4 to before 8.4p4; 8.3 to before 8.3p5 Fixed in 8.5p2, 8.4p4, 8.3p5 Patch available CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sailpoint:identityiq:*:*:*:*:*:*:*:* | before 8.3 | Vulnerable | SailPoint |
| cpe:2.3:a:sailpoint:identityiq:8.3:-:*:*:*:*:*:* | 8.3 | Vulnerable | SailPoint |
| cpe:2.3:a:sailpoint:identityiq:8.3:patch1:*:*:*:*:*:* | 8.3 patch1 | Vulnerable | SailPoint |
| cpe:2.3:a:sailpoint:identityiq:8.3:patch2:*:*:*:*:*:* | 8.3 patch2 | Vulnerable | SailPoint |
| cpe:2.3:a:sailpoint:identityiq:8.3:patch4:*:*:*:*:*:* | 8.3 patch4 | Vulnerable | SailPoint |
| cpe:2.3:a:sailpoint:identityiq:8.4:-:*:*:*:*:*:* | 8.4 | Vulnerable | SailPoint |
| cpe:2.3:a:sailpoint:identityiq:8.4:patch1:*:*:*:*:*:* | 8.4 patch1 | Vulnerable | SailPoint |
| cpe:2.3:a:sailpoint:identityiq:8.4:patch2:*:*:*:*:*:* | 8.4 patch2 | Vulnerable | SailPoint |
| cpe:2.3:a:sailpoint:identityiq:8.5:-:*:*:*:*:*:* | 8.5 | Vulnerable | SailPoint |
| cpe:2.3:a:sailpoint:identityiq:8.5:patch1:*:*:*:*:*:* | 8.5 patch1 | Vulnerable | SailPoint |
- cpe:2.3:a:sailpoint:identityiq:*:*:*:*:*:*:*:* Versions before 8.3 Vulnerable ·SailPoint
- cpe:2.3:a:sailpoint:identityiq:8.3:-:*:*:*:*:*:* Versions 8.3 Vulnerable ·SailPoint
- cpe:2.3:a:sailpoint:identityiq:8.3:patch1:*:*:*:*:*:* Versions 8.3 patch1 Vulnerable ·SailPoint
- cpe:2.3:a:sailpoint:identityiq:8.3:patch2:*:*:*:*:*:* Versions 8.3 patch2 Vulnerable ·SailPoint
- cpe:2.3:a:sailpoint:identityiq:8.3:patch4:*:*:*:*:*:* Versions 8.3 patch4 Vulnerable ·SailPoint
- cpe:2.3:a:sailpoint:identityiq:8.4:-:*:*:*:*:*:* Versions 8.4 Vulnerable ·SailPoint
- cpe:2.3:a:sailpoint:identityiq:8.4:patch1:*:*:*:*:*:* Versions 8.4 patch1 Vulnerable ·SailPoint
- cpe:2.3:a:sailpoint:identityiq:8.4:patch2:*:*:*:*:*:* Versions 8.4 patch2 Vulnerable ·SailPoint
- cpe:2.3:a:sailpoint:identityiq:8.5:-:*:*:*:*:*:* Versions 8.5 Vulnerable ·SailPoint
- cpe:2.3:a:sailpoint:identityiq:8.5:patch1:*:*:*:*:*:* Versions 8.5 patch1 Vulnerable ·SailPoint
Remediation
- Fix · CNA IdentityIQ (SailPoint Technologies) Fixed in 8.5p2, 8.4p4, 8.3p5
Timeline
- 2026-10-02 Threatist record created from CVE-2026-5712
- 2026-10-03 Alias added: GHSA-77mr-jp79-jwp3
- 2026-10-25 Priority changed: MEDIUM → LOW
References
More SailPoint Identityiq vulnerabilities
- TI-2024-10109 IdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control Vulnerability CVSS 3.1CRITICAL 10.0
- TI-2024-02067 IdentityIQ JavaServer Faces File Path Traversal Vulnerability CVSS 3.1CRITICAL 10.0
- TI-2026-10606 SailPoint IdentityIQ Improper Bearer Token Validation Vulnerability CVSS 3.1CRITICAL 9.8
- TI-2023-15516 SailPoint IdentityIQ Unsafe use of Reflection Vulnerability CVSS 3.1CRITICAL 9.0
- TI-2022-23181 SailPoint IdentityIQ JavaServer File Path Traversal Vulnerability CVSS 3.1HIGH 8.8
- TI-2024-02068 IdentityIQ Authorization of QuickLink Target Identities Vulnerability CVSS 3.1HIGH 8.8
Sources
- CVE-2026-5712 · CVE Program
- CVE-2026-5712 · NVD
- FIRST EPSS
- GHSA-77mr-jp79-jwp3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences