IdentityIQ 8.5 and 8.4 allow authenticated users who possess the Debug Pages Read Only capability or any custom capability containing the ViewAccessDebugPage SPRight to create new IdentityIQ objects without proper checks. This flaw, classified as CWE-863, can permit users to introduce or modify objects that may alter system configuration or grant additional permissions, thereby elevating privileges and compromising the integrity of the data and the confidentiality of the configuration. The issue does not expose information directly but enables a misuse of the system's object creation functionality.

SailPoint Technologies IdentityIQ versions 8.5 before patch level 8.5p2 and 8.4 before patch level 8.4p4 are impacted. Users of these releases with the specified capabilities are susceptible; no other versions are mentioned.

A CVSS score of 8.4 signals a high severity vulnerability and the lack of an EPSS value indicates that current exploitation probability is not quantified. The vulnerability appears to be exploitable only by authenticated internal users who have been granted the relevant debug-related capabilities. No public exploitation has been reported and the vulnerability is not listed in the CISA KEV catalog. Until a vendor‑issued security fix is available, the primary risk lies in privilege escalation for any identity that retains those debug capabilities, manipulating object creation control.