PT-2025-51916 · Homarr · Homarr

Meierschlumpf · Published 2025-12-17 · Updated 2025-12-20 · CVE-2025-67493

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Homarr versions prior to 1.45.3

Description A flaw exists in Homarr dashboard that, before version 1.45.3, could allow privilege escalation and access to other users' groups. This is due to insufficient input sanitization within the LDAP search query. An attacker with access to a user account could potentially exploit this issue in instances utilizing LDAP authentication.

Recommendations Update to version 1.45.3 or later.

Exploit

Fix

LPE

RCE

Weakness Enumeration

CWE-20

CWE-90

Related Identifiers

CVE-2025-67493

GHSA-59GP-Q3XX-489Q

Affected Products

Homarr

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67493.json · Exploit
• https://github.com/homarr-labs/homarr/security/advisories/GHSA-59gp-q3xx-489q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67493 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67493 · Vendor Advisory
• https://twitter.com/CVEnew/status/2002487824931852590 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2001495849495413076 · Twitter Post