CVE-2026-4857
SailPoint IdentityIQ Debug UI Incorrect Authorization
CVSS Score
8.4
EPSS Score
0.0%
EPSS Percentile
0th
IdentityIQ 8.5, all IdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ 8.4 patch levels prior to 8.4p4 allow authenticated users assigned the Debug Pages Read Only capability or any custom capability with the ViewAccessDebugPage SPRight to incorrectly create new IdentityIQ objects. Until a remediating security fix or patches containing this security fix are installed, the Debug Pages Read Only capability and any custom capabilities that contain the ViewAccessDebugPage SPRight should be unassigned from all identities and workgroups.
| CWE | CWE-863 |
| Vendor | sailpoint technologies |
| Product | identityiq |
| Published | Apr 15, 2026 |
| Last Updated | Apr 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for sailpoint technologies identityiq
Be the first to know when new high vulnerabilities affecting sailpoint technologies identityiq are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
SailPoint Technologies / IdentityIQ
8.5 < 8.5p2 8.4 < 8.4p4
References
Credits
🔍 wildwildwes