FirewallD provides dbus api for modification of configuration after user has been authenticated via polkit. This does not apply for 5 methods which can be called by any logged user using dbus api or firewall-cmd cli interface. Any predefined policy can be used, server or desktop.

list of concerned dbus methods in firewalld.py addPassthrough removePassthrough addEntry removeEntry setEntries

Any locally logged in user, could use the above firewalld commands to tamper or change the firewall settings.

This flaw was introduced via the following commit: https://github.com/t-woerner/firewalld/commit/6b9867cd5c5e2c83adeec42666521a420e59ef11

It affects all firewalld versions since 0.3.12