This flaw allows a low‑privilege domain user to modify internal LDB special records through LDAP, altering the DSDB module configuration and bypassing ACL enforcement for new LDAP connections. The result is an elevation of privileges that can culminate in a complete domain takeover. The weakness centers on authentication and access control (CWE‑284).

All Samba Active Directory Domain Controller installations are potentially vulnerable. The specific affected versions are not disclosed in the publicly available data, so any Samba AD DC that has not applied the latest patch should be considered at risk.

With a CVSS score of 8.8, the vulnerability is classified as high severity. Exploitation requires only authentication as a low‑privilege domain user, making the attack vector relatively straightforward for insiders or compromised accounts. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, but the combination of a high CVSS score and the ability to bypass ACLs indicates a significant risk if left unpatched.