A flaw was discovered in the 389 Directory Server that mis‑evaluates the SELFDN ACI bind‑rule, treating an anonymous LDAP client’s empty bind DN as a match against an empty stored attribute. This allows an unauthenticated client to satisfy access‑control checks that were designed to require a bound authenticated identity. As a result, the attacker can perform privileged LDAP operations such as adding or modifying directory entries that the SELFDN‑based ACI was intended to restrict. The weakness is classified as CWE‑863, a mismatch between access‑control and authentication handling.

Red Hat Directory Server versions 11, 12, and 13, which are included in Red Hat Enterprise Linux 6 through 10, are affected. The flaw applies to any instance of the 389 Directory Server running on these platforms, regardless of specific patch level.

The CVSS score of 7.5 indicates a high‑severity vulnerability, though no EPSS score is currently available. The flaw is not listed in the CISA KEV catalog. Exploitation requires only an unauthenticated, anonymous bind to the LDAP server with an empty DN, a capability commonly available to any network host that can reach the directory. Once authenticated checks are circumvented, an attacker can execute privileged operations, potentially compromising confidentiality and integrity of directory data. The CNA workaround mitigates the risk by enforcing non‑empty attribute values and restricting anonymous binds.