Identityiq
Approved changes feed: RSS · Atom
cpe:2.3:a:sailpoint_technologies:identityiq:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Sailpoint Technologies (a3feda49-dfb9-54a5-a9f8-1c941ab93368) |
|---|---|
| Product | Identityiq (cf661f4f-18c0-5414-a0d6-dbb107d55760) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-12341 |
vulnerable | 2026-07-29 00:23:32.259803 |
SailPoint IdentityIQ Improper Bearer Token Validation Vulnerability
HIGH (8.8)
This vulnerability
impacts all versions of IdentityIQ and allows an unauthenticated attacker
unauthorized access to protected APIs and data due to improper validation of
OAuth bearer tokens.
Published: 2026-07-20T18:22:36.997Z
Updated: 2026-07-21T12:32:33.109Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-5712 |
vulnerable | 2026-06-08 08:07:04.004526 |
IdentityIQ Role Editor Incorrect Authorization Vulnerability
HIGH (8)
This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definition of a role without having an assigned capability that would allow role editing.
Published: 2026-04-29T17:18:27.748Z
Updated: 2026-04-30T03:56:06.567Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-4857 |
vulnerable | 2026-06-08 08:07:02.541284 |
SailPoint IdentityIQ Debug UI Incorrect Authorization
HIGH (8.4)
IdentityIQ 8.5, all
IdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ
8.4 patch levels prior to 8.4p4 allow authenticated users assigned the Debug
Pages Read Only capability or any custom capability with the ViewAccessDebugPage
SPRight to incorrectly create new IdentityIQ objects. Until a remediating security fix or patches
containing this security fix are installed, the Debug Pages Read Only
capability and any custom capabilities that contain the ViewAccessDebugPage
SPRight should be unassigned from all identities and workgroups.
Published: 2026-04-15T18:08:45.737Z
Updated: 2026-04-16T03:55:39.481Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-10280 |
vulnerable | 2026-06-08 07:02:26.644207 |
Incorrect Content Type Cross-Site Scripting Vulnerability
HIGH (7.1)
IdentityIQ
8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and
all 8.3 patch levels including 8.3p5, and all prior versions allows some
IdentityIQ web services that provide non-HTML content to be accessed via a URL
path that will set the Content-Type to HTML allowing a requesting browser to
interpret content not properly escaped to prevent Cross-Site Scripting (XSS).
Published: 2025-11-03T16:35:56.241Z
Updated: 2026-11-04T00:12:59.919Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-10905 |
vulnerable | 2026-06-08 06:23:47.959909 |
IdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control Vulnerability
CRITICAL (10)
IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allow HTTP/HTTPS access to static content in the IdentityIQ application directory that should be protected.
Published: 2024-12-02T14:49:51.199Z
Updated: 2025-01-06T17:42:22.215Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.