The flaw in FreeIPA allows an authenticated host to retrieve and revoke certificates of other users because the system only checks that the host name matches the certificate’s subject Common Name, without validating ownership against the directory service. As a result, an enrolled host can effectively remove certificates belonging to other entities, disrupting secure communications and potentially denying service to legitimate users. This represents a moderate‑level privilege escalation that can undermine the integrity of authentication mechanisms.

The vulnerability affects Red Hat Enterprise Linux releases 10, 6, 7, 8, 9 where FreeIPA is deployed. No specific product versions are identified; any installation of FreeIPA on those OSes is potentially impacted.

The CVSS score is 5.4, indicating moderate severity. EPSS is not available and the CVE is not listed in the CISA KEV catalog, suggesting limited known exploitation. The attack requires an authenticated host within the same FreeIPA domain and relies on local privileges; therefore the threat vector is internal to the trusted network. Although the score is moderate, the potential to de‑authenticate services by revoking certificates makes it worth addressing promptly.