A flaw in FreeIPA's trust-fetch-domains command allows an authenticated, non-privileged IPA user to perform a privileged Active Directory trust refresh by exploiting incorrect authorization. The command is gated by a read-only permission instead of a trust-administration permission, enabling unauthorized modification of trusted-domain and ID-range identity data in the IPA LDAP directory. This vulnerability affects only servers with an active AD trust established via ipa-adtrust-install and ipa trust-add. Exploitation requires an authenticated non-admin user to trigger the command against an attacker-controlled server. Further impersonation of accounts in the trusted AD domain requires additional complex steps involving Kerberos traffic interception and cryptographic downgrades. The issue is fixed upstream, and administrators should apply the fix once available. Until then, restricting the "System: Read Trust Information" permission is a recommended interim mitigation.

An authenticated, non-privileged IPA user can cause the IdM server to launch a privileged process that refreshes Active Directory trust using attacker-controlled servers and credentials. This leads to unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory, potentially compromising identity management integrity. The vulnerability requires an existing cross-forest trust with Active Directory and an authenticated user account but no administrative privileges. There are no known exploits in the wild at this time.

This vulnerability is fixed upstream. Administrators should apply the official fix once it is available for their platform. Until the fix is applied, restricting the "System: Read Trust Information" permission so it is not granted to all authenticated users is a valid interim workaround. However, this restriction may affect SSSD subdomain support, which relies on the default permission breadth. No other mitigations are specified.