A flaw in 389 Directory Server allows CleanAllRUV and Abort CleanAllRUV replication‑maintenance extended operations to be executed without any authorization check. An unauthenticated client or an authenticated low‑privilege account can therefore remove a replica ID from the replication metadata, purge changelog records, or interrupt administrator‑initiated cleanup. The result is inconsistent or unavailable replication, which can undermine data consistency and availability for services relying on the directory.

The vulnerability affects Red Hat Directory Server versions 11, 12, and 13, as well as Red Hat Enterprise Linux releases 6 through 10 that are shipped with that package. Any system running those products and providing LDAP replication services is potentially impacted.

The CVSS score of 6.5 indicates a moderate severity risk. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation. Attackers can exploit this flaw remotely by connecting to the LDAP service; if nsslapd-allow-anonymous-access is enabled (the default) or by using any low‑privilege bound account, the vulnerable handlers can be invoked without further checks. The lack of an authorization guard makes the attack path straightforward, but the impact is limited to replication-related operations.