firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the (1) addPassthrough (2) removePassthrough (3) addEntry (4) removeEntry or (5) setEntries D-Bus API method.