Vulnerability · Published Dec 17, 2025 · Assigned by GitHub_M

CVE-2025-67493Homarr: missing input sanitization and possible privilege escalation through ldap search query injection

High 7.5

In plain English

A high-severity improper input validation in homarr from homarr-labs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 76.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Homarr is an open-source dashboard. Prior to version 1.45.3, it was possible to craft an input which allowed privilege escalation and getting access to groups of other users due to missing sanitization of inputs in ldap search query. The vulnerability could impact all instances using ldap authentication where a malicious actor had access to a user account. Version 1.45.3 has a patch for the issue.

Affected products (as reported)

Vendor	Product	Versions
homarr-labs	homarr	< 1.45.3

Weakness: CWE-20, CWE-90 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:L

References

https://github.com/homarr-labs/homarr/security/advisories/GHSA-59gp-q3xx-489q x_refsource_CONFIRM