Authorization Flaw in SailPoint IdentityIQ Affects User Capabilities

CVE-2026-4857

What is CVE-2026-4857?

The vulnerability in SailPoint's IdentityIQ versions 8.5 and 8.4 involves an authorization flaw that allows authenticated users with the Debug Pages Read Only capability or any custom capability containing the ViewAccessDebugPage SPRight to improperly create new IdentityIQ objects. This flaw can potentially lead to unauthorized access and manipulation of sensitive identity data. To mitigate this issue, it is advised that organizations temporarily revoke the Debug Pages Read Only capability and any custom capabilities that include the ViewAccessDebugPage SPRight from all identities and workgroups until a security patch is available.

References