Name: CVE-2026-19550: Incorrect Authorization
Creator: Rapid7
Published: 2026-08-11T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-19550, CWE-863, CVSS 8.2, EPSS 0.00381

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.

CVSS Details

CVSS 3.1 Base Score: 8.2
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade ipa-client-encrypted-dnsUpgrade python3-ipatestsUpgrade python3-ipalibUpgrade ipa-commonUpgrade ipa-clientUpgrade ipa-selinux-nfastUpgrade ipa-selinuxUpgrade ipa-server-commonUpgrade ipa-server-trust-adUpgrade ipa-client-commonUpgrade ipa-selinux-lunaUpgrade ipa-serverUpgrade python3-ipaclientUpgrade ipa-server-encrypted-dnsUpgrade python3-ipaserverUpgrade ipa-server-dnsUpgrade ipa-client-epnUpgrade ipa-client-samba	Oct 11, 2026	Sep 23, 2026
Freebsd	—	Upgrade freeipa-server	Sep 18, 2026	Sep 11, 2026
Redhat_linux	—	No solution existsUpgrade ipa-debugsourceUpgrade softhsm-develUpgrade ipa-client-epnUpgrade ipa-debuginfoUpgrade python3-ipaserverUpgrade opendnssec-debuginfoUpgrade python3-yubicoUpgrade ipa-selinuxUpgrade python3-qrcode-coreUpgrade ipa-server-dnsUpgrade ipa-healthcheck-coreUpgrade ipa-server-encrypted-dnsUpgrade slapi-nis-debugsourceUpgrade bind-dyndb-ldap-debugsourceUpgrade opendnssecUpgrade python3-qrcodeUpgrade ipa-selinux-lunaUpgrade ipa-serverUpgrade slapi-nisUpgrade python3-custodiaUpgrade softhsmUpgrade ipa-clientUpgrade ipa-python-compatUpgrade python3-ipatestsUpgrade ipa-client-commonUpgrade ipa-client-debuginfoUpgrade ipa-client-sambaUpgrade opendnssec-debugsourceUpgrade python3-ipaclientUpgrade ipa-selinux-nfastUpgrade slapi-nis-debuginfoUpgrade ipa-server-trust-ad-debuginfoUpgrade softhsm-debuginfoUpgrade ipa-client-encrypted-dnsUpgrade python3-kdcproxyUpgrade bind-dyndb-ldap-debuginfoUpgrade softhsm-debugsourceUpgrade python3-ipalibUpgrade ipa-server-trust-adUpgrade python3-jwcryptoUpgrade ipa-server-debuginfoUpgrade custodiaUpgrade bind-dyndb-ldapUpgrade ipa-server-commonUpgrade ipa-healthcheckUpgrade python3-pyusbUpgrade ipa-common	Aug 13, 2026	Aug 11, 2026
Rocky_linux	—	Upgrade ipa-server-debuginfoUpgrade ipa-server-trust-ad-debuginfoUpgrade ipa-client-epnUpgrade ipa-debugsourceUpgrade ipa-server-trust-adUpgrade ipa-debuginfoUpgrade ipa-client-sambaUpgrade ipa-clientUpgrade ipa-client-encrypted-dnsUpgrade ipa-serverUpgrade ipa-server-encrypted-dnsUpgrade ipa-client-debuginfo	Sep 28, 2026	Sep 24, 2026

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence