CVE-2026-19550 is a vulnerability in FreeIPA where the trust-fetch-domains command is improperly protected by a read-only permission on the trust object rather than a trust-administration permission. This misconfiguration allows an authenticated, non-privileged IPA user to initiate a privileged Active Directory trust refresh using attacker-supplied server and credentials. As a result, an attacker can modify trusted-domain and ID-range identity data within the IPA LDAP directory without authorization. The flaw only impacts FreeIPA servers configured with an Active Directory cross-forest trust. Exploitation requires network reachability from the IdM server to attacker infrastructure but does not require delegated administrative privileges. The vulnerability is classified under CWE-863 (Incorrect Authorization) and has a CVSS v3.1 base score of 4.3 (medium severity). No known exploits are reported in the wild. No explicit patch or fix is currently documented by the vendor advisory, but a suggested mitigation is to restrict the default "System: Read Trust Information" permission to reduce exposure, though this may impact legitimate functionality and should be tested before deployment.

An authenticated, non-privileged user on a FreeIPA server with Active Directory trust can trigger a privileged operation to refresh AD trust data using attacker-controlled credentials. This leads to unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory, impacting data integrity. There is no impact on confidentiality or availability reported. The vulnerability does not require administrative privileges but does require network access from the IdM server to attacker infrastructure. No known active exploitation is reported.

No official patch or fix is currently documented in the vendor advisory. Administrators of FreeIPA servers with Active Directory trust should consider restricting the default "System: Read Trust Information" permission so it is not granted to all authenticated users. This compensating control reduces exposure but may affect legitimate read-only lookups such as SSSD subdomain support and should be tested in a controlled environment before production deployment. Monitor vendor advisories for any forthcoming official fixes.