The vulnerability arises from the SELFDN ACI bind-rule evaluator in 389 Directory Server (Red Hat Directory Server 11) incorrectly treating an anonymous LDAP client's empty bind DN as matching an empty stored attribute value. This allows an unauthenticated client to satisfy access control checks that require a matching authenticated identity, enabling unauthorized operations such as adding or modifying directory entries. The flaw specifically affects deployments with ACIs using userattr="attribute#SELFDN" or userattr="attribute#USERDN" bind rules on attributes permitted to hold empty values. Red Hat Directory Server does not include such ACIs by default, so exploitation depends on deployment specifics. The CVSS 3.1 base score is 7.5 (high severity) with network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No known exploits are reported in the wild. No patch or official fix is currently available, and mitigation involves configuration review and restricting anonymous access.

An unauthenticated attacker can bypass intended access control restrictions by exploiting the incorrect matching of empty bind DN values, allowing unauthorized modification or addition of directory entries that should be restricted to specific authenticated users. There is no confidentiality or availability impact demonstrated. The severity depends on whether the vulnerable ACI configuration is present in the deployment, as Red Hat Directory Server does not ship such ACIs by default.

Until an official fix is available, administrators should review all ACIs using userattr="...#SELFDN" bind rules and ensure the target attribute cannot be set to an empty value. Alternatively, add explicit authmethod restrictions to prevent anonymous binds from satisfying the check. Disabling anonymous access to the directory entirely removes the attack surface. Monitor Red Hat's advisory for updates on patch availability.