Improper Authorization configuration vulnerability in the System Security Services Daemon (SSSD) when integrated with Microsoft Active Directory. The flaw arises because, by default, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is not enabled, allowing incorrect mapping of Kerberos principals to local users. An attacker with the ability to modify Active Directory attributes (userPrincipalName or samAccountName) can impersonate privileged accounts such as root or Administrator. This can lead to privilege escalation on domain-joined Linux systems using GSSAPI or password-based authentication.