What is the CVSS score of EUVD-2026-26260?

EUVD-2026-26260 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of SailPoint IdentityIQ are affected by EUVD-2026-26260?

SailPoint IdentityIQ contains an authorization bypass in versions prior to 8.3p5, 8.4p4, and 8.5p2 that allows authenticated users assigned to work items to modify role definitions without proper…. A patch is available.

How to fix or mitigate EUVD-2026-26260?

Within 24 hours, query all SailPoint IdentityIQ deployments to identify current patch levels and determine which environments require remediation. Within 7 days, deploy vendor-released patches (upgrade to IdentityIQ 8.3p5, 8.4p4, or 8.5p2 depending on your deployed version) to all affected systems, prioritizing production instances; coordinate with identity governance and operations teams to schedule patching with minimal business disruption. Within 30 days, audit role definition change logs for the preceding 90 days to detect any unauthorized modifications, and review authentication logs for exploitation attempts against the vulnerability.

SailPoint IdentityIQ EUVD-2026-26260

| CVE-2026-5712 HIGH

Incorrect Authorization (CWE-863)

2026-04-29 SailPoint

Authentication Bypass Identityiq Sailpoint Technologies

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Authenticated user with a specific work-item relationship (PR:L, AC:H, UI:R) edits roles that govern other systems (S:C), yielding high C/I/A via access manipulation.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 01:37 vuln.today

Patch released

Apr 30, 2026 - 15:48 nvd

Patch available

Apr 29, 2026 - 19:02 EUVD

EUVD ID Assigned

Apr 29, 2026 - 18:00 euvd

EUVD-2026-26260

CVE Published

Apr 29, 2026 - 17:18 nvd

HIGH 8.0

DescriptionCVE.org

This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definition of a role without having an assigned capability that would allow role editing.

AnalysisAI

Incorrect authorization in SailPoint IdentityIQ lets an authenticated user who is the requestor or assignee of a work item edit the definition of a role even though they lack the capability that normally gates role editing. All versions prior to the 8.3p5, 8.4p4, and 8.5p2 patch levels are affected, enabling privilege-boundary bypass within the identity governance platform itself. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.04%), but the technical impact is rated total because roles drive downstream access across connected systems.

Technical ContextAI

IdentityIQ is SailPoint's on-premise identity governance and administration (IGA) platform, where 'roles' are the central abstraction that bundles entitlements and provisions access across connected downstream applications and systems. The flaw is a CWE-863 Incorrect Authorization: the role editor enforces authorization based on a user's relationship to a work item (being its requestor or assignee) rather than strictly on the assigned capability that is supposed to gate role definition changes. Per the CPE (cpe:2.3:a:sailpoint_technologies:identityiq:*), the vulnerable component is the IdentityIQ application's role-editing workflow, and the SSVC 'Technical Impact: total' rating reflects that manipulating a role definition can alter the access granted to many identities, not just the attacker.

RemediationAI

Apply the vendor patch appropriate to your branch: upgrade IdentityIQ 8.3 to 8.3p5 or later, 8.4 to 8.4p4 or later, and 8.5 to 8.5p2 or later, per the SailPoint security advisory (https://www.sailpoint.com/security-advisories/sailpoint-identityiq-role-editor-incorrect-authorization-vulnerability-cve-2026-5712). Because a patch is available from the vendor, patching is the primary and recommended fix. As interim compensating controls until the patch is applied, tighten who can be assigned as requestor or assignee on work items that touch role definitions, review and restrict membership of role-editing and work-item workflows, and enable auditing/alerting on changes to role definitions so unauthorized edits are detected quickly; note these controls reduce but do not eliminate the exposure and may add operational friction to legitimate access-request workflows. Verify no unauthorized role changes have already occurred by reviewing role-definition audit history.