IdentityIQ vulnerabilities

A vulnerability in IdentityIQ (all versions) allows an unauthenticated user to perform remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content.

All versions of IdentityIQ are vulnerable to unauthorized access to protected APIs and data due to improper validation of OAuth bearer tokens. An unauthenticated attacker can exploit this.

This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definition of a role without having an assigned capability that would allow role editing.