User with expired account may be granted with invalid permission.
vulners.com/securityvulns/securityvulns:doc:3747