IdentityIQ CVE-2026-5712: Authenticated Users Can Edit Roles

The National Vulnerability Database has disclosed CVE-2026-5712, a high-severity vulnerability impacting all versions of IdentityIQ. This flaw, rated 8.0 on the CVSS scale, allows an authenticated user who is either a requestor or assignee of a work item to modify role definitions. Critically, this can be achieved even without the necessary assigned capabilities for role editing.

This is a bypass of authorization controls (CWE-863) that could have significant implications for access governance. An attacker with low-level authenticated access could potentially elevate privileges or manipulate critical role configurations within IdentityIQ, disrupting segregation of duties and potentially granting themselves or others broader access than intended. The attack complexity is rated as high, suggesting some specific conditions or user interaction might be required, but the impact on confidentiality, integrity, and availability is severe.

CISOs need to understand that this isn’t an unauthenticated RCE, but an internal authorization bypass. The attacker’s calculus here is privilege escalation and lateral movement. They’re already inside, and this vulnerability gives them a path to manipulate the very system designed to manage access. Defenders must prioritize patching IdentityIQ and reviewing audit logs for any unauthorized role definition changes.