Threats affecting pkg:maven/com.sailpoint/identityiq

CVE-2026-5712 is a high-severity vulnerability in SailPoint Technologies IdentityIQ versions 8.3, 8.4, and 8.5. It allows an authenticated user who is the requestor or assignee of a work item to edit role definitions without having the proper role editing capability. This represents an incorrect authorization flaw (CWE-863) that could lead to unauthorized privilege escalation or role modification. No official patch or remediation guidance is currently available from the vendor. The vulnerability has not been reported as exploited in the wild.

CVE-2026-4857 is a high-severity authorization vulnerability in SailPoint Technologies IdentityIQ versions 8.4 and 8.5, including patch levels prior to 8.4p4 and 8.5p2. Authenticated users with the Debug Pages Read Only capability or any custom capability containing the ViewAccessDebugPage SPRight can incorrectly create new IdentityIQ objects. This improper authorization flaw could lead to unauthorized creation of objects within the system. No official patch or fix has been confirmed as available at this time. Until a fix is released, it is recommended to unassign the Debug Pages Read Only capability and any custom capabilities with the ViewAccessDebugPage SPRight from all identities and workgroups to mitigate risk.