CVE-2022-45435 SailPoint IdentityIQ Access Control Bypass

Medium 6.8 Published 31 Jan 2023 Updated 27 Mar 2025

Authenticated users with specific capabilities can bypass authorization checks to modify work item forwarding configurations for unauthorized identities.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-45435?

CVE-2022-45435 is a medium-severity missing authorization vulnerability in SailPoint IdentityIQ, published on 31 Jan 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6, and all prior versions allow authenticated users assigned the Identity Administrator capability or any custom capability that contains the SetIdentityForwarding right to modify the work item forwarding configuration for identities other than the ones that should be allowed by Lifecycle Manager Quicklink Population configuration.

Weakness: CWE-863

Which versions are affected by CVE-2022-45435?

It affects 1 product.

Products include Sailpoint Identityiq.

How do I fix CVE-2022-45435?

No fix has been published for CVE-2022-45435 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-45435 being exploited?

There is no known exploitation of CVE-2022-45435 in the wild and no public exploit code.

Sources

Also known as GHSA-hp2j-x7vv-r597.