Critical severity · published Dec 17, 2025
CVE-2025-67493
Homarr: missing input sanitization and possible privilege escalation through ldap search query injection
9.0
CVSS
0.3%
EPSS
No
On KEV
Description
Homarr is an open-source dashboard. Prior to version 1.45.3, it was possible to craft an input which allowed privilege escalation and getting access to groups of other users due to missing sanitization of inputs in ldap search query. The vulnerability could impact all instances using ldap authentication where a malicious actor had access to a user account. Version 1.45.3 has a patch for the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HO
homarr · homarr-labs
< 1.45.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-67493
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-67493
Vendor Advisory
https://github.com/homarr-labs/homarr/security/advisories/GHSA-59gp-q3xx-489q
More from homarr
8.8
CVE-2026-33510
DOM-Based XSS in Homarr /auth/login Redirect
7.5
CVE-2026-27796
Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak)
6.1
CVE-2025-64759
Homarr is Vulnerable to Stored Cross-Site Scripting (XSS) and Possible Privilege Escalation via Malicious SVG Upload
5.3
CVE-2026-27797
Homarr: Unauthenticated SSRF in rssFeed.ts
5.3
CVE-2026-25123
Homarr affected by Unauthenticated SSRF / Port-Scan Primitive via widget.app.ping