CVE-2025-67493

Homarr: missing input sanitization and possible privilege escalation through ldap search query injection

State: Published
Severity: 7.5 High
Published: Dec 17, 2025
Updated: May 22, 2026
Reserved: Dec 8, 2025

Description

Homarr is an open-source dashboard. Prior to version 1.45.3, it was possible to craft an input which allowed privilege escalation and getting access to groups of other users due to missing sanitization of inputs in ldap search query. The vulnerability could impact all instances using ldap authentication where a malicious actor had access to a user account. Version 1.45.3 has a patch for the issue.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:L	GitHub_M

Weaknesses

CWE-20 Improper Input Validation
CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

Affected Products

Product	Versions
homarrhomarr-labs	< 1.45.3Affected

References

https://github.com/homarr-labs/homarr/security/advisories/GHSA-59gp-q3xx-489q

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.