This vulnerability in IdentityIQ affects all listed versions and permits an authenticated identity involved in a work item (either as requestor or assignee) to bypass authorization controls and edit role definitions without the assigned capability to do so. The issue is classified as CWE-863 (Incorrect Authorization). The CVSS 3.1 base score is 8.0, indicating high severity, with network attack vector, high complexity, low privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. No patch or official remediation level has been provided by SailPoint as of the publication date.

An attacker with authenticated access and involvement in a work item can modify role definitions without proper authorization. This could lead to unauthorized privilege escalation, potentially compromising the integrity and confidentiality of the identity and access management system. The vulnerability affects core role management functions, which are critical for enforcing access controls.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should carefully review and restrict who can be assigned as requestors or assignees of work items, and monitor for suspicious role modification activities. Avoid granting unnecessary access to work item assignments to reduce risk.