CVE-2026-4857 (GCVE-0-2026-4857)

Vulnerability from cvelistv5 – Published: 2026-04-15 18:08 – Updated: 2026-04-16 03:55
VLAI?
Title
SailPoint IdentityIQ Debug UI Incorrect Authorization
Summary
IdentityIQ 8.5, all IdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ 8.4 patch levels prior to 8.4p4 allow authenticated users assigned the Debug Pages Read Only capability or any custom capability with the ViewAccessDebugPage SPRight to incorrectly create new IdentityIQ objects.  Until a remediating security fix or patches containing this security fix are installed, the Debug Pages Read Only capability and any custom capabilities that contain the ViewAccessDebugPage SPRight should be unassigned from all identities and workgroups.
Severity ?
8.4 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CWE
  • CWE-863 - Incorrect Authorization
Assigner
References
Impacted products
Vendor Product Version
SailPoint Technologies IdentityIQ Affected: 8.5 , < 8.5p2 (custom)
Affected: 8.4 , < 8.4p4 (custom)
Create a notification for this product.
Credits
wildwildwes
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4857",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-15T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-16T03:55:39.481Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "IdentityIQ",
          "vendor": "SailPoint Technologies",
          "versions": [
            {
              "lessThan": "8.5p2",
              "status": "affected",
              "version": "8.5",
              "versionType": "custom"
            },
            {
              "lessThan": "8.4p4",
              "status": "affected",
              "version": "8.4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "wildwildwes"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\n\n\u003cp\u003e\u003cspan\u003eIdentityIQ 8.5, all\nIdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ\n8.4 patch levels prior to 8.4p4 allow authenticated users assigned the Debug\nPages Read Only capability or any custom capability with the ViewAccessDebugPage\nSPRight to incorrectly create new IdentityIQ objects.\u003cspan\u003e\u0026nbsp; \u003c/span\u003eUntil a remediating security fix or patches\ncontaining this security fix are installed, the Debug Pages Read Only\ncapability and any custom capabilities that contain the ViewAccessDebugPage\nSPRight should be unassigned from all identities and workgroups.\u003c/span\u003e\u003c/p\u003e\n\n\u003c/div\u003e"
            }
          ],
          "value": "IdentityIQ 8.5, all\nIdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ\n8.4 patch levels prior to 8.4p4 allow authenticated users assigned the Debug\nPages Read Only capability or any custom capability with the ViewAccessDebugPage\nSPRight to incorrectly create new IdentityIQ objects.\u00a0 Until a remediating security fix or patches\ncontaining this security fix are installed, the Debug Pages Read Only\ncapability and any custom capabilities that contain the ViewAccessDebugPage\nSPRight should be unassigned from all identities and workgroups."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-15T18:13:53.171Z",
        "orgId": "2cfc7547-56a0-4049-8b52-c3078e8a8719",
        "shortName": "SailPoint"
      },
      "references": [
        {
          "url": "https://www.sailpoint.com/security-advisories/sailpoint-identityiq-debug-ui-incorrect-authorization-vulnerability-cve-2026-4857"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "SailPoint IdentityIQ Debug UI Incorrect Authorization",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2cfc7547-56a0-4049-8b52-c3078e8a8719",
    "assignerShortName": "SailPoint",
    "cveId": "CVE-2026-4857",
    "datePublished": "2026-04-15T18:08:45.737Z",
    "dateReserved": "2026-03-25T15:51:35.248Z",
    "dateUpdated": "2026-04-16T03:55:39.481Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-4857",
      "date": "2026-04-17",
      "epss": "0.00033",
      "percentile": "0.09461"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-4857\",\"sourceIdentifier\":\"psirt@sailpoint.com\",\"published\":\"2026-04-15T19:16:37.730\",\"lastModified\":\"2026-04-17T15:08:01.337\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IdentityIQ 8.5, all\\nIdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ\\n8.4 patch levels prior to 8.4p4 allow authenticated users assigned the Debug\\nPages Read Only capability or any custom capability with the ViewAccessDebugPage\\nSPRight to incorrectly create new IdentityIQ objects.\u00a0 Until a remediating security fix or patches\\ncontaining this security fix are installed, the Debug Pages Read Only\\ncapability and any custom capabilities that contain the ViewAccessDebugPage\\nSPRight should be unassigned from all identities and workgroups.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@sailpoint.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.7,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"psirt@sailpoint.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]}],\"references\":[{\"url\":\"https://www.sailpoint.com/security-advisories/sailpoint-identityiq-debug-ui-incorrect-authorization-vulnerability-cve-2026-4857\",\"source\":\"psirt@sailpoint.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-4857\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-15T18:32:08.513579Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-15T18:32:45.456Z\"}}], \"cna\": {\"title\": \"SailPoint IdentityIQ Debug UI Incorrect Authorization\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"wildwildwes\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"SailPoint Technologies\", \"product\": \"IdentityIQ\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.5\", \"lessThan\": \"8.5p2\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"8.4\", \"lessThan\": \"8.4p4\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.sailpoint.com/security-advisories/sailpoint-identityiq-debug-ui-incorrect-authorization-vulnerability-cve-2026-4857\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"IdentityIQ 8.5, all\\nIdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ\\n8.4 patch levels prior to 8.4p4 allow authenticated users assigned the Debug\\nPages Read Only capability or any custom capability with the ViewAccessDebugPage\\nSPRight to incorrectly create new IdentityIQ objects.\\u00a0 Until a remediating security fix or patches\\ncontaining this security fix are installed, the Debug Pages Read Only\\ncapability and any custom capabilities that contain the ViewAccessDebugPage\\nSPRight should be unassigned from all identities and workgroups.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cdiv\u003e\\n\\n\u003cp\u003e\u003cspan\u003eIdentityIQ 8.5, all\\nIdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ\\n8.4 patch levels prior to 8.4p4 allow authenticated users assigned the Debug\\nPages Read Only capability or any custom capability with the ViewAccessDebugPage\\nSPRight to incorrectly create new IdentityIQ objects.\u003cspan\u003e\u0026nbsp; \u003c/span\u003eUntil a remediating security fix or patches\\ncontaining this security fix are installed, the Debug Pages Read Only\\ncapability and any custom capabilities that contain the ViewAccessDebugPage\\nSPRight should be unassigned from all identities and workgroups.\u003c/span\u003e\u003c/p\u003e\\n\\n\u003c/div\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-863\", \"description\": \"CWE-863: Incorrect Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"2cfc7547-56a0-4049-8b52-c3078e8a8719\", \"shortName\": \"SailPoint\", \"dateUpdated\": \"2026-04-15T18:13:53.171Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-4857\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-16T03:55:39.481Z\", \"dateReserved\": \"2026-03-25T15:51:35.248Z\", \"assignerOrgId\": \"2cfc7547-56a0-4049-8b52-c3078e8a8719\", \"datePublished\": \"2026-04-15T18:08:45.737Z\", \"assignerShortName\": \"SailPoint\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.