Skip to main content

Identityiq CVE-2026-4857

| EUVDEUVD-2026-23007 HIGH
Incorrect Authorization (CWE-863)
2026-04-15 SailPoint
Authentication Bypass Identityiq Sailpoint Technologies
8.4
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.4 HIGH
AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 26, 2026 - 15:23 vuln.today
Patch released
Apr 17, 2026 - 15:08 nvd
Patch available
Patch available
Apr 16, 2026 - 05:29 EUVD
8.5p2,8.4p4
EUVD ID Assigned
Apr 15, 2026 - 18:45 euvd
EUVD-2026-23007
CVE Published
Apr 15, 2026 - 18:08 nvd
HIGH 8.4

DescriptionCVE.org

IdentityIQ 8.5, all IdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ 8.4 patch levels prior to 8.4p4 allow authenticated users assigned the Debug Pages Read Only capability or any custom capability with the ViewAccessDebugPage SPRight to incorrectly create new IdentityIQ objects.  Until a remediating security fix or patches containing this security fix are installed, the Debug Pages Read Only capability and any custom capabilities that contain the ViewAccessDebugPage SPRight should be unassigned from all identities and workgroups.

AnalysisAI

Incorrect authorization in SailPoint IdentityIQ 8.4 and 8.5 allows authenticated users with the Debug Pages Read Only capability (or any custom capability containing ViewAccessDebugPage SPRight) to create IdentityIQ objects, bypassing intended read-only restrictions. This enables privilege escalation to full system compromise through object creation. No active exploitation reported; a vendor patch is available.

More in Identityiq

View all
CVE-2026-12341 CRITICAL
9.8 Jul 20

Authentication bypass in SailPoint IdentityIQ lets an unauthenticated remote attacker reach protected APIs and data beca
CVE-2024-10905 CRITICAL
9.8 Dec 02

IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, Identity
CVE-2024-2228 HIGH
8.8 Mar 22

This vulnerability allows an authenticated user to perform a Lifecycle Manager flow or other QuickLink for a target user
CVE-2023-32217 HIGH
8.8 Jun 05

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, Identity
CVE-2026-5712 HIGH
8.0 Apr 29

Incorrect authorization in SailPoint IdentityIQ lets an authenticated user who is the requestor or assignee of a work it
CVE-2024-2227 HIGH
7.5 Mar 22

This vulnerability allows access to arbitrary files in the application server file system due to a path traversal vulner
CVE-2024-1714 HIGH
7.1 Feb 21

An issue exists in all supported versions of IdentityIQ Lifecycle Manager that can result if an entitlement with a value
CVE-2025-10280 HIGH
7.1 Nov 03

IdentityIQ 8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and all 8.3 patch levels includin

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2026-42016 HIGH POC
8.8
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-4857 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy