CVE-2025-67493: CWE-20: Improper Input Validation in homarr-labs homarr
Homarr is an open-source dashboard. Prior to version 1.45.3, it was possible to craft an input which allowed privilege escalation and getting access to groups of other users due to missing sanitization of inputs in ldap search query. The vulnerability could impact all instances using ldap authentication where a malicious actor had access to a user account. Version 1.45.3 has a patch for the issue.
AI Analysis
Technical Summary
Homarr, an open-source dashboard, contained an input validation flaw in its LDAP search query handling before version 1.45.3. This flaw allowed a malicious user with an account to craft inputs that bypassed sanitization, resulting in privilege escalation and unauthorized access to other users' group information. The vulnerability is classified under CWE-20 (Improper Input Validation) and CWE-90 (LDAP Injection). The vendor released version 1.45.3 to address and fix this issue.
Potential Impact
Exploitation of this vulnerability could allow an authenticated user to escalate privileges and gain unauthorized access to groups of other users within the LDAP authentication context. This compromises confidentiality and integrity of user group data. The CVSS v3.1 base score is 7.5 (High), reflecting network attack vector, high privileges required, user interaction needed, and significant impact on confidentiality and integrity.
Mitigation Recommendations
Upgrade all affected homarr instances to version 1.45.3 or later, which includes the official patch fixing the improper input validation in LDAP queries. No other mitigations are indicated or required once patched.
CVE-2025-67493: CWE-20: Improper Input Validation in homarr-labs homarr
Description
Homarr is an open-source dashboard. Prior to version 1.45.3, it was possible to craft an input which allowed privilege escalation and getting access to groups of other users due to missing sanitization of inputs in ldap search query. The vulnerability could impact all instances using ldap authentication where a malicious actor had access to a user account. Version 1.45.3 has a patch for the issue.
CVSS v3.1
Score 7.5high
Affected software
pkg:github/homarr-labs/homarrRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Homarr, an open-source dashboard, contained an input validation flaw in its LDAP search query handling before version 1.45.3. This flaw allowed a malicious user with an account to craft inputs that bypassed sanitization, resulting in privilege escalation and unauthorized access to other users' group information. The vulnerability is classified under CWE-20 (Improper Input Validation) and CWE-90 (LDAP Injection). The vendor released version 1.45.3 to address and fix this issue.
Potential Impact
Exploitation of this vulnerability could allow an authenticated user to escalate privileges and gain unauthorized access to groups of other users within the LDAP authentication context. This compromises confidentiality and integrity of user group data. The CVSS v3.1 base score is 7.5 (High), reflecting network attack vector, high privileges required, user interaction needed, and significant impact on confidentiality and integrity.
Mitigation Recommendations
Upgrade all affected homarr instances to version 1.45.3 or later, which includes the official patch fixing the improper input validation in LDAP queries. No other mitigations are indicated or required once patched.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2025-12-08T18:49:47.487Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 69432d1e058703ef3fc81e16
Added to database: 12/17/2025, 22:22:22 UTC
Last enriched: 05/23/2026, 06:13:32 UTC
Last updated: 09/10/2026, 19:36:51 UTC
Views: 231
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.