A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.
CVE-2025-0620
CVSS base score
4.9 (v3.1)
Severity
MEDIUM
Attack vector
Network
Weakness
CWE-552
Last modified
November 5, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected products
samba samba
References
- access.redhat.com Third Party Advisory
- bugzilla.redhat.com Issue Tracking, Third Party Advisory
- www.samba.org Vendor Advisory
- www.openwall.com Mailing List, Third Party Advisory