CVE-2024-10905

CVE-2024-10905 affects SailPoint IdentityIQ 8.2, 8.3, 8.4 and prior versions, where HTTP/HTTPS access to static content in the IdentityIQ application directory is improperly allowed. Root cause cited as improper handling of file names identifying virtual resources (CWE-66). Impact is high: potent...

CVE-2024-2227

IdentityIQ (SailPoint) is affected by a JavaServer Faces path traversal vulnerability (JSF 2.2.20) that allows reading arbitrary files from the application server filesystem. Root cause: path traversal in JSF 2.2.20, as described in CVE-2020-6950 lineage. Affected IdentityIQ versions include 8.3 ...

CVE-2022-46835

IdentityIQ CVE-2022-46835 is a path traversal in JavaServer Faces (JSF) 2.2.20 that allows reading arbitrary files from the application server filesystem. Affected: IdentityIQ 8.3 (all 8.3 patch levels before 8.3p2), 8.2 (before 8.2p5), 8.1 (before 8.1p7), 8.0 (before 8.0p6). Root cause reference...

CVE-2024-1714

CVE-2024-1714 affects IdentityIQ Lifecycle Manager. The issue is that an entitlement value containing leading or trailing whitespace can be requested by an authenticated user in an access request, impacting all supported versions. The provided connected sources describe the vulnerability but do n...

CVE-2024-2228

The CVE-2024-2228 issue relates to IdentityIQ/QuickLink authorization in SAP Lifecycle Manager. Connected sources indicate an authenticated user can perform a Lifecycle Manager flow or other QuickLink targeting a user outside the defined QuickLink Population. The root cause details are not fully ...

CVE-2022-45435

IdentityIQ vulnerability CVE-2022-45435 affects IdentityIQ versions 8.3 (through 8.3p1), 8.2 (through 8.2p4), 8.1 (through 8.1p6), 8.0 (through 8.0p5), and earlier. The issue allows authenticated users with the Identity Administrator capability or any custom capability containing the SetIdentityF...

CVE-2023-32217

CVE-2023-32217 affects SailPoint IdentityIQ versions 8.0 through 8.3 (with patches up to 8.0p6, 8.1p7, 8.2p6, 8.3p3 respectively). The issue stems from unsafe use of reflection that allows an authenticated user to invoke a Java constructor with no arguments or a single Map argument in any Java cl...

CVE-2026-12341

CVE-2026-12341 affects all versions of SailPoint IdentityIQ. The root cause is improper validation of OAuth bearer tokens, allowing an unauthenticated attacker to gain unauthorized access to protected APIs and data. Documented impact is high/critical (authentication bypass leading to exposure of ...

CVE-2025-10280

Concretely affects SailPoint IdentityIQ: versions 8.5, 8.4 (before 8.4p4), 8.3 (including 8.3p5) and earlier allow some web services to return non-HTML content with a Content-Type HTML header, enabling XSS. Root cause is incorrect content-type handling by IdentityIQ web services. Remediation per ...

CVE-2026-5712

IdentityIQ (all versions) is affected: an authenticated user who is the requestor or assignee of a work item can edit a role definition without having the capability to do so. Underlying issue is incorrect authorization. CVSS v3.1 base score 8.0 (HIGH) with network attack vector, high complexity,...