Unauthorized Access Vulnerability in IdentityIQ by SailPoint
CVE-2026-12341

8.8HIGH

Key Information:

Vendor

Sailpoint Technologies

Status
Identityiq
Vendor
CVE Published:
20 July 2026

What is CVE-2026-12341?

A serious vulnerability exists in SailPoint's IdentityIQ, affecting all versions. An unauthenticated attacker can exploit this flaw to gain unauthorized access to sensitive APIs and data, primarily due to improper validation of OAuth bearer tokens. Organizations using IdentityIQ must ensure they are aware of this security risk to protect their data integrity and application security.

Affected Version(s)

IdentityIQ 8.5 <= 8.5p1

IdentityIQ 8.5 <= 8.5p1

IdentityIQ 8.4 <= 8.4p4

References

https://www.sailpoint.com/security-advisories/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.