CVE-2026-5712 IdentityIQ Role Editor Incorrect Authorization Vulnerability
Authenticated users can modify role definitions without proper authorization, potentially escalating privileges or altering access controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-5712?
CVE-2026-5712 is a high-severity missing authorization vulnerability in SailPoint Technologies IdentityIQ, published on 29 Apr 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definition of a role without having an assigned capability that would allow role editing.
Weakness: CWE-863
Which versions are affected by CVE-2026-5712?
It affects 1 product.
Products include Sailpoint Identityiq.
How do I fix CVE-2026-5712?
No fix has been published for CVE-2026-5712 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-5712 being exploited?
There is no known exploitation of CVE-2026-5712 in the wild and no public exploit code.
Other vulnerabilities in SailPoint Technologies IdentityIQ
- CVE-2024-10905 IdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control Vulnerability
- CVE-2024-2227 IdentityIQ JavaServer Faces File Path Traversal Vulnerability
- CVE-2023-32217 SailPoint IdentityIQ Unsafe use of Reflection Vulnerability
- CVE-2026-12341 SailPoint IdentityIQ Improper Bearer Token Validation Vulnerability
- CVE-2022-46835 SailPoint IdentityIQ JavaServer File Path Traversal Vulnerability
Sources
Also known as GHSA-77mr-jp79-jwp3.