CVE-2026-90462

A flaw was found in SSSD. When configured with the LDAP access provider and ldap_access_order including ppolicy or lockout, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision, permitting continued authorization for a deleted or deprovisioned user. A remote attacker with prior valid account context could exploit this to maintain access to information and potentially make limited modifications to resources that should no longer be available.

This Moderate impact flaw in SSSD allows a deleted or deprovisioned user to retain authorization under specific non-default LDAP access control configurations. Exploitation requires SSSD to be configured with access_provider = ldap and ldap_access_order including ppolicy or lockout, along with pre-existing local SSSD user state. This issue does not affect default SSSD configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

There's no available mitigation for this issue.