CVE-2026-4857CWE-863

SailPoint IdentityIQ Debug UI Incorrect Authorization

High · published April 15, 2026

CVSS v3.1
8.4
EPSS
0%
Percentile
30.6
In the wild
Unconfirmed
What it is

IdentityIQ 8.5, all

IdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ

8.4 patch levels prior to 8.4p4 allow authenticated users assigned the Debug

Pages Read Only capability or any custom capability with the ViewAccessDebugPage

SPRight to incorrectly create new IdentityIQ objects.  Until a remediating security fix or patches

containing this security fix are installed, the Debug Pages Read Only

capability and any custom capabilities that contain the ViewAccessDebugPage

SPRight should be unassigned from all identities and workgroups.

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00378 · 30.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-04-15T18:08Z
EPSS history
Timeline
  • 15 APR 18:08Z
    SailPoint IdentityIQ Debug UI Incorrect Authorization
    cvelistv5