CVE-2025-7493

Freeipa: idm: privilege escalation from host to domain admin in freeipa

CRITICAL 9.1

At a glance

Source: NVD
EPSS: EPSS 0.56 % · percentile 46 (2026-10-28)
State: PUBLISHED
Published: 2025-09-30 15:06 UTC
Updated: 2026-02-26 17:47 UTC
Assigner: redhat
NVD status: Deferred

Description

A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for the admin@REALM credential, FreeIPA still does not validate the root@REALM canonical name, which can also be used as the realm administrator's name. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.

Weaknesses (CWE)

CWE-1220 — Insufficient Granularity of Access Control

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	CRITICAL 9.1	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	redhat
CVSS 3.1	CRITICAL 9.1	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	NVD · secalert@redhat.com (Secondary)

European references

ENISA EUVD · EUVD-2025-31739
GCVE · GCVE-0-2025-7493

Affected products

Product	Versions
Red Hat · Red Hat Enterprise Linux 10	unaffected 0:4.12.2-15.el10_0.4 < *
Red Hat · Red Hat Enterprise Linux 7 Extended Lifecycle Support	unaffected 0:4.6.8-5.el7_9.23 < *
Red Hat · Red Hat Enterprise Linux 8	unaffected 8100020250919180242.143e9e98 < *
Red Hat · Red Hat Enterprise Linux 8	unaffected 8100020250918211722.823393f5 < *
Red Hat · Red Hat Enterprise Linux 8.2 Advanced Update Support	unaffected 8020020250924110056.50ea30f9 < *
Red Hat · Red Hat Enterprise Linux 8.2 Advanced Update Support	unaffected 8020020250924104944.792f4060 < *
Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	unaffected 8040020250923180004.f153676a < *
Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	unaffected 8040020250923175408.5b01ab7e < *
Red Hat · Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	unaffected 8040020250923180004.f153676a < *
Red Hat · Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	unaffected 8040020250923175408.5b01ab7e < *
Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	unaffected 8060020250916172436.c1533a64 < *
Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	unaffected 8060020250916174421.ada582f1 < *
Red Hat · Red Hat Enterprise Linux 8.6 Telecommunications Update Service	unaffected 8060020250916172436.c1533a64 < *
Red Hat · Red Hat Enterprise Linux 8.6 Telecommunications Update Service	unaffected 8060020250916174421.ada582f1 < *
Red Hat · Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	unaffected 8060020250916172436.c1533a64 < *
Red Hat · Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	unaffected 8060020250916174421.ada582f1 < *
Red Hat · Red Hat Enterprise Linux 8.8 Telecommunications Update Service	unaffected 8080020250918184739.e581a9e4 < *
Red Hat · Red Hat Enterprise Linux 8.8 Telecommunications Update Service	unaffected 8080020250918152850.b0a6ceea < *
Red Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	unaffected 8080020250918184739.e581a9e4 < *
Red Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	unaffected 8080020250918152850.b0a6ceea < *

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD