CVE-2025-0620 Samba: smbd doesn't pick up group membership changes when re-authenticating an expired smb session
Samba fails to update group memberships during session re-authentication, allowing unauthorized access to file shares until clients reconnect.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-0620?
CVE-2025-0620 is a medium-severity missing authorization vulnerability in Samba Samba, published on 6 Jun 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.
Weakness: CWE-552
Which versions are affected by CVE-2025-0620?
It affects 1 product.
Linux distribution packages (3)
samba SUSE:Linux Enterprise High Availability Extension 15 SP7 | All versions | 4.21.6+git.402.80f493f530f-150700.3.3.1 |
samba SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 4.21.6+git.402.80f493f530f-150700.3.3.1 |
samba openSUSE:Tumbleweed | All versions | 4.22.2+git.396.c752843dcf4-1.1 |
Products include Samba Samba.
How do I fix CVE-2025-0620?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-0620 being exploited?
There is no known exploitation of CVE-2025-0620 in the wild and no public exploit code.
Other vulnerabilities in Samba Samba
Sources
Also known as ALPINE-CVE-2025-0620, CLSA-2026-1778859875, DEBIAN-CVE-2025-0620, GHSA-8q8w-8225-6gq4, SUSE-SU-2025:02230-1, USN-7564-1 and 1 more.