Sailpoint Identityiq
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Sailpoint Identityiq.
By the Year
In 2026 there have been 2 vulnerabilities in Sailpoint Identityiq with an average score of 8.2 out of ten. Last year, in 2025 Identityiq had 1 security vulnerability published. That is, 1 more vulnerability have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 1.10.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 2 | 8.20 |
| 2025 | 1 | 7.10 |
| 2024 | 2 | 0.00 |
| 2023 | 3 | 7.60 |
It may take a day or so for new Identityiq vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Sailpoint Identityiq Security Vulnerabilities
IdentityIQ All Versions Role Edit Privilege Escalation
CVE-2026-5712
8 - High
- April 29, 2026
This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definition of a role without having an assigned capability that would allow role editing.
AuthZ
IdentityIQ 8.5/8.4 Vulnerable to Auth Object Creation via Debug Pages
CVE-2026-4857
8.4 - High
- April 15, 2026
IdentityIQ 8.5, all IdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ 8.4 patch levels prior to 8.4p4 allow authenticated users assigned the Debug Pages Read Only capability or any custom capability with the ViewAccessDebugPage SPRight to incorrectly create new IdentityIQ objects. Until a remediating security fix or patches containing this security fix are installed, the Debug Pages Read Only capability and any custom capabilities that contain the ViewAccessDebugPage SPRight should be unassigned from all identities and workgroups.
AuthZ
XSS via Content-Type in SailPoint IdentityIQ 8.4p1-8.4p3
CVE-2025-10280
7.1 - High
- November 03, 2025
IdentityIQ 8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and all 8.3 patch levels including 8.3p5, and all prior versions allows some IdentityIQ web services that provide non-HTML content to be accessed via a URL path that will set the Content-Type to HTML allowing a requesting browser to interpret content not properly escaped to prevent Cross-Site Scripting (XSS).
XSS
SailPoint IdentityIQ: Unprotected Static Content Access Vulnerability
CVE-2024-10905
- December 02, 2024
IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allow HTTP/HTTPS access to static content in the IdentityIQ application directory that should be protected.
IdentityIQ Auth Bypass via Whitespace in Entitlement Value
CVE-2024-1714
- February 21, 2024
An issue exists in all supported versions of IdentityIQ Lifecycle Manager that can result if an entitlement with a value containing leading or trailing whitespace is requested by an authenticated user in an access request.
Auth User May Invoke Any Java Constructor in IdentityIQ 8.x (pre patches)
CVE-2023-32217
8.8 - High
- June 05, 2023
IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow an authenticated user to invoke a Java constructor with no arguments or a Java constructor with a single Map argument in any Java class available in the IdentityIQ application classpath.
Reflection Injection
IdentityIQ <8.3p2/8.2p5/8.1p7/8.0p6 Path Traversal via JSF 2.2.20
CVE-2022-46835
7.5 - High
- January 31, 2023
IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow access to arbitrary files in the application server filesystem due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950.
Directory traversal
IdentityIQ 8.3 Admin Can Modify Identity Forwarding (SetIDForward) Pre8.3p2
CVE-2022-45435
6.5 - Medium
- January 31, 2023
IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6, and all prior versions allow authenticated users assigned the Identity Administrator capability or any custom capability that contains the SetIdentityForwarding right to modify the work item forwarding configuration for identities other than the ones that should be allowed by Lifecycle Manager Quicklink Population configuration.
AuthZ
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Sailpoint Identityiq or by Sailpoint? Click the Watch button to subscribe.
