CVE-2026-19404Medium· 6.5▾ SunlitA flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-ano…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled (the default), or any authenticated low-privilege user to invoke them otherwise. This allows removal of a replica ID from replication metadata, purging of changelog records, and interruption of administrator-initiated cleanup, which can leave replication inconsistent or unavailable.
389-ds-base (all versions)389-ds-base (all versions)389-ds-base (all versions)389-ds-base (all versions)389-ds-base389-ds-base (all versions)389-ds-base (all versions)389-ds-base (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Set nsslapd-allow-anonymous-access to rootdse or off as an interim mitigation. Note this only blocks exploitation by fully unauthenticated (unbound) clients; any connection that has completed a successful bind with any DN, including a low-privileged account, still reaches the vulnerable handlers with no further authorization check. Restrict replication LDAP ports to trusted networks as defense in depth pending a code fix.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114232High· 8.1Keycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource access
CVE-2026-111253Medium· 6.6Dnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign d-bus callers to replace another client's resolved transaction
CVE-2026-107912High· 7.7Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw
CVE-2024-9671Medium· 5.3System: pdf invoices of the developer users can be seen if the url is known
CVE-2024-8445Medium· 5.7389-ds-base: server crash while modifying `userpassword` using malformed input (incomplete fix for cve-2024-2199)
CVE-2024-1062Medium· 5.5389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr)