CVE-2024-2228: SailPoint IdentityIQ Auth Bypass Flaw

CVE-2024-2228 Overview

CVE-2024-2228 is a high-severity authorization flaw in SailPoint IdentityIQ. The vulnerability allows an authenticated user to execute a Lifecycle Manager flow or other QuickLink against a target user who falls outside the defined QuickLink Population scope. This breaks the intended access boundary that restricts which identities a requester can act upon through QuickLinks.

The weakness is categorized as improper privilege management [CWE-269]. An attacker with low-privilege access can leverage the flaw to affect confidentiality, integrity, and availability of identity data across the enterprise.

Critical Impact
Authenticated attackers can run identity lifecycle actions against arbitrary users, bypassing scoped QuickLink Population controls and enabling unauthorized account changes.

Affected Products

SailPoint IdentityIQ 8.1 (patches 1 through 6)
SailPoint IdentityIQ 8.2 (base and patches 1, 2, 4, 5)
SailPoint IdentityIQ 8.3 (base, patch 1, patch 2) and IdentityIQ 8.4 (base)

Discovery Timeline

2024-03-22 - CVE CVE-2024-2228 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2228

Vulnerability Analysis

SailPoint IdentityIQ uses QuickLinks to expose self-service and delegated administrative actions such as password resets, account requests, and Lifecycle Manager events. Each QuickLink is bound to a QuickLink Population that defines which identities the requester may act upon. This scoping is the primary access control for delegated administration workflows.

CVE-2024-2228 breaks that boundary. An authenticated user can invoke a QuickLink action for a target identity outside the defined Population. Because Lifecycle Manager flows can create, modify, or disable accounts and trigger provisioning changes, the impact extends beyond the intended scope into privileged identity operations.

The flaw is a horizontal privilege escalation. Low-privilege help-desk or business users can act on identities reserved for other populations, including higher-privilege administrative accounts, depending on the QuickLinks configured in the deployment.

Root Cause

The root cause is missing or incorrectly enforced authorization when a QuickLink action is executed. The QuickLink Population is evaluated for UI presentation and initial request routing, but the server-side handler does not consistently re-validate that the target identity belongs to the caller's Population before executing the flow.

Attack Vector

Exploitation is performed over the network by an authenticated user. No user interaction is required from the victim. The attacker submits a QuickLink or Lifecycle Manager request with a target identity identifier outside their assigned Population. The server processes the request and applies the intended action to the unauthorized target identity.

Refer to the SailPoint Security Advisory for authoritative technical details and patch mapping. No public proof-of-concept has been published.

Detection Methods for CVE-2024-2228

Indicators of Compromise

Lifecycle Manager or QuickLink events in IdentityIQ audit logs where the requester's Population does not include the target identity.
Unexpected password resets, account enablements, or role changes attributed to non-administrative accounts.
Bursts of QuickLink requests from a single session targeting multiple identities across different business units.

Detection Strategies

Review IdentityIQ audit and provisioning logs for LifecycleManager and QuickLink actions, correlating the requester identity with the target identity's Population membership.
Build alerts in your SIEM for QuickLink activity where requester and target belong to different organizational scopes.
Baseline normal QuickLink usage per user and alert on deviations in target count, target diversity, or action type.

Monitoring Recommendations

Forward IdentityIQ audit logs to a centralized data lake for correlation with authentication and provisioning telemetry.
Monitor administrative accounts for unsolicited password resets or attribute changes originating from QuickLink flows.
Track failed and successful authorization checks on QuickLink endpoints to detect enumeration behavior.

How to Mitigate CVE-2024-2228

Immediate Actions Required

Apply the SailPoint-provided patch for your IdentityIQ version as listed in the SailPoint Security Advisory.
Inventory all configured QuickLinks and QuickLink Populations, and disable any that are not actively required.
Audit recent Lifecycle Manager activity for actions performed against identities outside the requester's assigned Population.

Patch Information

SailPoint has issued security patches for affected IdentityIQ 8.1, 8.2, 8.3, and 8.4 releases. Customers should authenticate to the SailPoint Compass portal and consult the SailPoint Security Advisory for the specific patch level required for their deployment.

Workarounds

Restrict QuickLink availability to the smallest set of users required for business operations until patches are applied.
Tighten QuickLink Population definitions and remove wildcard or overly broad Population rules.
Enable verbose auditing on QuickLink and Lifecycle Manager actions to support detection while remediation is in progress.

bash

# Configuration example
# Review the SailPoint Security Advisory for version-specific patch guidance:
# https://www.sailpoint.com/security-advisories/