SSSD allows a fail‑open condition during the LDAP policy check when the ldap_access_order includes ppolicy or lockout and a user lookup returns no results. The component incorrectly returns success and caches the allow decision, enabling a deleted or deprovisioned user to continue to be authorized even though they should no longer have access.

Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4 running SSSD with LDAP as an access provider are affected when ppolicy or lockout is listed in ldap_access_order. Any installation of SSSD on these distributions that uses this configuration may be vulnerable, regardless of the specific patch level.

The CVSS score of 5.4 indicates a moderate risk. No EPSS score is available and the vulnerability is not listed in CISA KEV. Exploitation requires an attacker to already have valid account credentials; the flaw allows them to maintain access after account deprovisioning. Attackers can therefore read confidential information or make limited modifications to resources that should otherwise be inaccessible.