Riskcovery

CVE-2025-7493

Freeipa: idm: privilege escalation from host to domain admin in freeipa

State
Published
Severity
9.1 Critical
Published
Sep 30, 2025
Updated
Feb 26, 2026
Reserved
Jul 11, 2025

Read the record on cve.org

Description

A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for the admin@REALM credential, FreeIPA still does not validate the root@REALM canonical name, which can also be used as the realm administrator's name. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.

Scores

CVSSScoreVectorSource
3.19.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hredhat

Weaknesses

  • CWE-1220 Insufficient Granularity of Access Control

Affected Products

ProductVersions
Red Hat Enterprise Linux 10Red Hat
  • 0:4.12.2-15.el10_0.4 and laterNot affected
Red Hat Enterprise Linux 7 Extended Lifecycle SupportRed Hat
  • 0:4.6.8-5.el7_9.23 and laterNot affected
Red Hat Enterprise Linux 8Red Hat
  • 8100020250919180242.143e9e98 and laterNot affected
Red Hat Enterprise Linux 8Red Hat
  • 8100020250918211722.823393f5 and laterNot affected
Red Hat Enterprise Linux 8.2 Advanced Update SupportRed Hat
  • 8020020250924110056.50ea30f9 and laterNot affected
Red Hat Enterprise Linux 8.2 Advanced Update SupportRed Hat
  • 8020020250924104944.792f4060 and laterNot affected
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat
  • 8040020250923180004.f153676a and laterNot affected
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat
  • 8040020250923175408.5b01ab7e and laterNot affected
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnRed Hat
  • 8040020250923180004.f153676a and laterNot affected
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnRed Hat
  • 8040020250923175408.5b01ab7e and laterNot affected
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRed Hat
  • 8060020250916172436.c1533a64 and laterNot affected
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRed Hat
  • 8060020250916174421.ada582f1 and laterNot affected
Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceRed Hat
  • 8060020250916172436.c1533a64 and laterNot affected
Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceRed Hat
  • 8060020250916174421.ada582f1 and laterNot affected
Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsRed Hat
  • 8060020250916172436.c1533a64 and laterNot affected
Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsRed Hat
  • 8060020250916174421.ada582f1 and laterNot affected
Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceRed Hat
  • 8080020250918184739.e581a9e4 and laterNot affected
Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceRed Hat
  • 8080020250918152850.b0a6ceea and laterNot affected
Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsRed Hat
  • 8080020250918184739.e581a9e4 and laterNot affected
Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsRed Hat
  • 8080020250918152850.b0a6ceea and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 0:4.12.2-14.el9_6.5 and laterNot affected
Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsRed Hat
  • 0:4.9.8-11.el9_0.5 and laterNot affected
Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsRed Hat
  • 0:4.10.1-12.el9_2.6 and laterNot affected
Red Hat Enterprise Linux 9.4 Extended Update SupportRed Hat
  • 0:4.11.0-15.el9_4.7 and laterNot affected
Red Hat Enterprise Linux 6Red Hat

    References

    Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.