Samba Group Membership Change Not Reflected in Re-authenticated SMB Sessions

A flaw in Samba's smbd service daemon allows file shares to remain accessible even after group membership changes are made in Active Directory. This issue arises because Samba does not update group membership information when re-authenticating an expired SMB session. As a result, changes made by an administrator may not take effect until the user disconnects and reconnects to the server. This vulnerability affects all versions of Samba starting from 4.21.0.

Impact

Exploitation of this vulnerability can lead to unauthorized access to file shares, as group membership changes are not recognized during session re-authentication.

Remediation

Users can upgrade to Samba version 4.21.6, which addresses this vulnerability. The update is available for download from the Samba download site.