CVE-2026-76560
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated identity. This can allow an anonymous LDAP client to perform an operation, such as adding or modifying a directory entry, that a SELFDN-based ACI intended to restrict to a specific authenticated user.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS probability
- 0.37%
- CWE
- CWE-863
- Published
- 2026-09-07
- Last modified
- 2026-09-09
Affected products
- Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
- Red Hat Red Hat Directory Server 11.7 E4S for RHEL 8
- Red Hat Red Hat Directory Server 12.2 E4S for RHEL 9
- Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
- Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
- Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
- Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
- Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Weakness type
Related vulnerabilities
- CVE-2026-85978 — Unauthenticated Remote Code Execution in Akana API Platform
- CVE-2026-14892 — Tanium addressed an improper access controls vulnerability in Tanium Server.
- CVE-2026-87046 — Tanium addressed an improper access controls vulnerability in Comply.
- CVE-2026-87075 — Tanium addressed an improper access controls vulnerability in Comply.
- CVE-2026-87544 — Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote...
- CVE-2026-87575 — Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...
- CVE-2026-87473 — Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36 allowed a remote...
- CVE-2026-87509 — Incorrect authorization in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a...