CVE-2026-5712
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definition of a role without having an assigned capability that would allow role editing.
Risk Assessment
The organization may be exposed to unauthorized changes in role definitions, which could lead to violations of security policies and unauthorized access to resources.
Recommendation
It is recommended to review and restrict user permissions for role editing and to update the system to the latest version to minimize risk.
Other vulnerabilities in IdentityIQ
See all- CVE-2026-12342Critical
A vulnerability in IdentityIQ (all versions) allows an unauthenticated user to perform remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content.
- CVE-2026-12341High
All versions of IdentityIQ are vulnerable to unauthorized access to protected APIs and data due to improper validation of OAuth bearer tokens. An unauthenticated attacker can exploit this.
Original NVD description (English source)
This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definition of a role without having an assigned capability that would allow role editing.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS