CVE-2025-67493
Published: 17 December 2025
Summary
CVE-2025-67493 is a high-severity Improper Input Validation (CWE-20) vulnerability in Homarr Homarr. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 16.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-67493 is an improper input validation vulnerability (CWE-20, CWE-90) in Homarr, an open-source dashboard. In versions prior to 1.45.3, the application fails to sanitize inputs used in LDAP search queries, enabling attackers to manipulate queries for privilege escalation and unauthorized access to other users' groups. This issue affects all Homarr instances configured with LDAP authentication.
A malicious actor requires access to any valid user account within a vulnerable Homarr instance using LDAP authentication to exploit the flaw. By crafting a specially designed input for the LDAP search query, the attacker can escalate their privileges and obtain membership in groups belonging to other users. Successful exploitation grants high confidentiality and integrity impacts, with a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:L), reflecting network accessibility but dependence on high privileges, user interaction, and high attack complexity, with changed scope.
The official advisory from the Homarr project at https://github.com/homarr-labs/homarr/security/advisories/GHSA-59gp-q3xx-489q confirms the vulnerability and states that version 1.45.3 includes a patch addressing the input sanitization deficiency in LDAP queries. Security practitioners should upgrade affected instances to 1.45.3 or later to mitigate the risk.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-203997
Vulnerability details
Homarr is an open-source dashboard. Prior to version 1.45.3, it was possible to craft an input which allowed privilege escalation and getting access to groups of other users due to missing sanitization of inputs in ldap search query. The vulnerability…
more
could impact all instances using ldap authentication where a malicious actor had access to a user account. Version 1.45.3 has a patch for the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables privilege escalation via LDAP query manipulation (T1068) and unauthorized addition to other users' groups (T1098.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of application inputs, such as those in LDAP search queries, to prevent crafted inputs from enabling privilege escalation.
Mandates timely identification, testing, and installation of software patches, such as Homarr version 1.45.3, to remediate the input validation flaw and prevent exploitation.
Enforces least privilege for user accounts, limiting the scope and impact of privilege escalation even if attackers craft malicious LDAP inputs using a valid account.