{"id":"CVE-2026-4857","state":"PUBLISHED","title":"SailPoint IdentityIQ Debug UI Incorrect Authorization","description":"IdentityIQ 8.5, all\nIdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ\n8.4 patch levels prior to 8.4p4 allow authenticated users assigned the Debug\nPages Read Only capability or any custom capability with the ViewAccessDebugPage\nSPRight to incorrectly create new IdentityIQ objects.  Until a remediating security fix or patches\ncontaining this security fix are installed, the Debug Pages Read Only\ncapability and any custom capabilities that contain the ViewAccessDebugPage\nSPRight should be unassigned from all identities and workgroups.","publishedAt":"2026-04-15T18:08:45.737Z","updatedAt":"2026-04-16T03:55:39.481Z","severity":{"score":8.4,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","source":"SailPoint"},"assigner":"SailPoint","products":["SailPoint Technologies IdentityIQ"],"affected":[{"vendor":"SailPoint Technologies","product":"IdentityIQ","defaultStatus":"unaffected","versions":[{"version":"8.5","status":"affected","lessThan":"8.5p2","versionType":"custom"},{"version":"8.4","status":"affected","lessThan":"8.4p4","versionType":"custom"}]}],"references":["https://www.sailpoint.com/security-advisories/sailpoint-identityiq-debug-ui-incorrect-authorization-vulnerability-cve-2026-4857"],"weaknesses":["CWE-863"],"ingestedAt":"2026-10-29T20:12:16.098Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/4xxx/CVE-2026-4857.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-4857","state":"PUBLISHED","datePublished":"2026-04-15T18:08:45.737Z","dateUpdated":"2026-04-16T03:55:39.481Z","assignerShortName":"SailPoint","assignerOrgId":"2cfc7547-56a0-4049-8b52-c3078e8a8719","dateReserved":"2026-03-25T15:51:35.248Z"},"containers":{"cna":{"title":"SailPoint IdentityIQ Debug UI Incorrect Authorization","descriptions":[{"lang":"en","value":"IdentityIQ 8.5, all\nIdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ\n8.4 patch levels prior to 8.4p4 allow authenticated users assigned the Debug\nPages Read Only capability or any custom capability with the ViewAccessDebugPage\nSPRight to incorrectly create new IdentityIQ objects.  Until a remediating security fix or patches\ncontaining this security fix are installed, the Debug Pages Read Only\ncapability and any custom capabilities that contain the ViewAccessDebugPage\nSPRight should be unassigned from all identities and workgroups."}],"affected":[{"vendor":"SailPoint Technologies","product":"IdentityIQ","defaultStatus":"unaffected","versions":[{"version":"8.5","status":"affected","lessThan":"8.5p2","versionType":"custom"},{"version":"8.4","status":"affected","lessThan":"8.4p4","versionType":"custom"}]}],"references":[{"url":"https://www.sailpoint.com/security-advisories/sailpoint-identityiq-debug-ui-incorrect-authorization-vulnerability-cve-2026-4857"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"HIGH","baseScore":8.4,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","lang":"en","description":"CWE-863: Incorrect Authorization","type":"CWE"}]}],"providerMetadata":{"shortName":"SailPoint","orgId":"2cfc7547-56a0-4049-8b52-c3078e8a8719","dateUpdated":"2026-04-15T18:13:53.171Z"},"credits":[{"lang":"en","value":"wildwildwes","type":"reporter"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.1"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-15T00:00:00+00:00","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2026-4857"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-16T03:55:39.481Z"}}]}}}