This vulnerability (CVE-2026-5712) affects all listed versions of SailPoint IdentityIQ and involves incorrect authorization (CWE-863). Specifically, an authenticated identity involved in a work item can modify role definitions without possessing the required permissions to do so. The CVSS 3.1 base score is 8.0, reflecting network attack vector, high complexity, low privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. No patch or official remediation level has been published by SailPoint, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation allows an authenticated user with limited privileges (requestor or assignee of a work item) to escalate their permissions by editing role definitions. This can lead to unauthorized changes in access control, compromising confidentiality, integrity, and availability of the system. The vulnerability poses a significant risk to identity and access management within affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user roles to minimize exposure, and monitor for unusual role modification activities. Avoid assigning work items to users who should not have role editing capabilities. Follow SailPoint's future advisories for updates on patches or official mitigations.