CVE-2025-7493: Critical Flaw in FreeIPA Allows Host Users to Escalate to Domain Administrator

CVE-2025-7493 is described by the FreeIPA Team as a critical privilege escalation flaw that could allow attackers to elevate privileges from a host-level account to a domain administrator. The vulnerability carries a CVSS score of 9.1, underscoring the serious risk to organisations using FreeIPA for identity and authentication management.

The advisory notes that the weakness continues from CVE-2025-4404, with incomplete uniqueness checks in Kerberos attributes and cross-attribute uniqueness in the 389-ds LDAP server, enabling an attacker to masquerade as the root user within a domain. To address this, the 389-ds LDAP server uniqueness plugin was extended to enforce cross-attribute uniqueness checks, and FreeIPA 4.12.5 includes the complete fix.

The advisory also states that Kerberos tickets are now rejected if they lack a PAC structure, and since FreeIPA 4.9.0 deployments have been configured to issue PACs and associate SIDs with accounts to improve validation and prevent identity spoofing. Administrators running earlier versions are urged to upgrade to 4.12.5 or later and enable SID and PAC generation to mitigate the risk. According to the FreeIPA Team, environments without PAC issuance remain vulnerable, as the Kerberos KDC-side fix cannot help where no PAC is issued.