The vulnerability allows an authenticated identity who is a requestor or assignee of a work item to edit the definition of a role without possessing the required capability. This flaw enables an attacker to modify role configurations and elevate privileges beyond what their assigned permissions allow.

SailPoint Technologies IdentityIQ – all product versions are impacted. No specific version ranges are listed, so any deployed instance of IdentityIQ is potentially vulnerable.

The CVSS score of 8 indicates a high severity vulnerability. Because the exploitable conditions require only an authenticated user who is the requestor or assignee of a work item, the attack can be carried out by anyone who has legitimate access to the system and holds such a role. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of public exploitation data does not diminish the risk for organizations that have this flaw present. The primary risk is the potential for an attacker to alter role definitions and thereby gain unauthorized authority within the identity management environment.