The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission.
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
No PoCs found on GitHub currently.