{"id":"DEBIAN-CVE-2026-76578","details":"A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.","modified":"2026-09-24T08:47:34.325074576Z","published":"2026-09-07T13:20:36.850Z","upstream":["CVE-2026-76578"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-76578"}],"affected":[{"package":{"name":"freeipa","ecosystem":"Debian:12","purl":"pkg:deb/debian/freeipa?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.10.1+dfsg1-1+exp1","4.10.1-1+exp1","4.10.2-1","4.10.2-2","4.10.2-2+exp1","4.11.1-1","4.11.1-1+exp1","4.11.1-2","4.11.1-2+exp1","4.11.1-2.1","4.12.2-1","4.12.2-2","4.12.2-3","4.12.4-1","4.12.4-2","4.13.1-1","4.9.11-1","4.9.11-1+exp1","4.9.11-2"],"ecosystem_specific":{"urgency":"unimportant"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-76578.json"}},{"package":{"name":"freeipa","ecosystem":"Debian:13","purl":"pkg:deb/debian/freeipa?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.4-1","4.12.4-2","4.13.1-1"],"ecosystem_specific":{"urgency":"unimportant"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-76578.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}