A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade freeipa-server | Sep 18, 2026 | Sep 11, 2026 |
| Redhat_linux | — | Upgrade ipa-client-debuginfoUpgrade ipa-client-sambaUpgrade ipa-server-trust-adUpgrade ipa-client-commonUpgrade ipa-server-trust-ad-debuginfoUpgrade python3-ipalibUpgrade ipa-commonUpgrade ipa-client-encrypted-dnsUpgrade python3-ipatestsUpgrade python3-ipaclientUpgrade ipa-selinux-nfastUpgrade ipa-server-debuginfoUpgrade ipa-server-commonUpgrade ipa-selinux-lunaUpgrade ipa-debugsourceNo solution existsUpgrade ipa-selinuxUpgrade ipa-server-encrypted-dnsUpgrade ipa-clientUpgrade ipa-serverUpgrade ipa-server-dnsUpgrade ipa-client-epnUpgrade ipa-debuginfoUpgrade python3-ipaserver | Aug 13, 2026 | Aug 11, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub