CVE-2025-0620 Details
Description
A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.
A flaw in Samba's smbd service daemon allows file shares to remain accessible even after group membership changes are made in Active Directory. This issue arises because Samba does not update group membership information when re-authenticating an expired SMB session. As a result, changes made by an administrator may not take effect until the user disconnects and reconnects to the server. This vulnerability affects all versions of Samba starting from 4.21.0.
Users can upgrade to Samba version 4.21.6, which addresses this vulnerability. The update is available for download from the Samba download site.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2025/06/03/8 | CVE | Mailing ListThird Party Advisory |
| https://access.redhat.com/security/cve/CVE-2025-0620 | [email protected] | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2370453 | [email protected] | Issue TrackingThird Party Advisory |
| https://www.samba.org/samba/security/CVE-2025-0620.html | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-552 | Files or Directories Accessible to External Parties | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| samba samba | >= 4.21.0, < 4.21.6 >= 4.22.0, < 4.22.2 |
CPE
Remediation
| |
Change History
12 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 31, 2026 | CVE Modified | CVE |
| Aug 31, 2026 | CVE Modified | [email protected] |
| Aug 21, 2026 | CVE Modified | [email protected] |
| Jun 30, 2026 | CVE Modified | [email protected] |
| Jun 25, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 8, 2026 | CVE Modified | [email protected] |
| Nov 18, 2025 | Reanalysis | [email protected] |
| Aug 13, 2025 | Initial Analysis | [email protected] |
| Jun 6, 2025 | New CVE Received | [email protected] |
| Jun 6, 2025 | CVE Modified | CVE |