Description:
Delegation rules allow a "proxy" service to impersonate any user to access another "target" service. The vulnerability allows an attacker, once they managed to compromise a service which is a proxy in at least one delegation rule, to impersonate any user against any service that is not a target service in one of its delegation rule.

As an example, it would allow an attacker, after they compromised a server having a delegation rule to an NFS server, to impersonate a
domain administrator against a FreeIPA server. This would mean compromising the all domain.

If there are no custom delegation rules in a FreeIPA domain, this vulnerability will most likely have no impact.