This vulnerability in FreeIPA arises because the trust-fetch-domains command is gated by a read-only permission on the trust object rather than the intended trust-administration permission. As a result, an authenticated, non-privileged IPA user can invoke a privileged Active Directory trust refresh using attacker-controlled server and credentials. This leads to unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data stored in the IPA LDAP directory. The issue affects only Identity Management servers with an established cross-forest trust to Active Directory (configured via ipa-adtrust-install and ipa trust-add). Exploitation requires network access from the IdM server to attacker-controlled infrastructure but no elevated user privileges. The vulnerability impacts integrity by allowing unauthorized modification of identity data. No official patch or remediation level is stated in the vendor advisory as of the publication date. The vendor suggests a compensating control by restricting the "System: Read Trust Information" permission to reduce exposure, with caution due to potential impact on legitimate read-only lookups.

An authenticated, non-privileged IPA user can cause unauthorized modification of trusted-domain and ID-range identity data in the IPA LDAP directory by triggering a privileged Active Directory trust refresh with attacker-supplied credentials. This compromises the integrity of identity data within the IdM/FreeIPA server. There is no direct impact on confidentiality or availability reported. Exploitation requires network reachability from the IdM server to attacker-controlled infrastructure but no administrative privileges are needed. This could allow an attacker to manipulate trust relationships and identity ranges, potentially affecting authentication and authorization processes relying on this data.

No official patch or fix is currently confirmed for this vulnerability. Administrators of IdM/FreeIPA servers with Active Directory trusts should consider restricting the default "System: Read Trust Information" permission so it is not granted to all authenticated users. This is a suggested compensating control and should be tested carefully before applying in production environments, as it may affect legitimate read-only lookups such as SSSD subdomain support. Monitor the Red Hat advisory page for updates on official fixes or patches.