Sailpoint Technologies
Monthly
Authentication bypass in SailPoint IdentityIQ lets an unauthenticated remote attacker reach protected APIs and data because OAuth bearer tokens are improperly validated. The flaw (CWE-287) affects all IdentityIQ versions up to the patched releases 8.5p1, 8.4p4, and 8.3p5, and carries a critical CVSS of 9.8. No public exploit identified at time of analysis and EPSS is low (0.22%), but the total technical impact against an identity-governance platform makes it a high-priority patch.
Incorrect authorization in SailPoint IdentityIQ lets an authenticated user who is the requestor or assignee of a work item edit the definition of a role even though they lack the capability that normally gates role editing. All versions prior to the 8.3p5, 8.4p4, and 8.5p2 patch levels are affected, enabling privilege-boundary bypass within the identity governance platform itself. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.04%), but the technical impact is rated total because roles drive downstream access across connected systems.
Incorrect authorization in SailPoint IdentityIQ 8.4 and 8.5 allows authenticated users with the Debug Pages Read Only capability (or any custom capability containing ViewAccessDebugPage SPRight) to create IdentityIQ objects, bypassing intended read-only restrictions. This enables privilege escalation to full system compromise through object creation. No active exploitation reported; a vendor patch is available.
Authentication bypass in SailPoint IdentityIQ lets an unauthenticated remote attacker reach protected APIs and data because OAuth bearer tokens are improperly validated. The flaw (CWE-287) affects all IdentityIQ versions up to the patched releases 8.5p1, 8.4p4, and 8.3p5, and carries a critical CVSS of 9.8. No public exploit identified at time of analysis and EPSS is low (0.22%), but the total technical impact against an identity-governance platform makes it a high-priority patch.
Incorrect authorization in SailPoint IdentityIQ lets an authenticated user who is the requestor or assignee of a work item edit the definition of a role even though they lack the capability that normally gates role editing. All versions prior to the 8.3p5, 8.4p4, and 8.5p2 patch levels are affected, enabling privilege-boundary bypass within the identity governance platform itself. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.04%), but the technical impact is rated total because roles drive downstream access across connected systems.
Incorrect authorization in SailPoint IdentityIQ 8.4 and 8.5 allows authenticated users with the Debug Pages Read Only capability (or any custom capability containing ViewAccessDebugPage SPRight) to create IdentityIQ objects, bypassing intended read-only restrictions. This enables privilege escalation to full system compromise through object creation. No active exploitation reported; a vendor patch is available.