Homarr CVE-2025-67493

Exploitation requires that the Homarr instance be configured to use LDAP authentication - instances using local/other authentication backends are not affected. The attacker must already have access to a valid (low-privilege) user account on the instance (PR:L), making this a post-authentication privilege-escalation rather than an unauthenticated attack. Affected versions are all releases prior to 1.45.3; upgrading to 1.45.3 remediates the flaw. The primary limiting factors are therefore the LDAP-auth deployment mode and the need for pre-existing authenticated access, which together narrow the realistic attacker population to insiders or anyone able to obtain a low-tier account.

This is a genuinely high-priority flaw for the subset of deployments that match its preconditions, but not a mass-exploitation threat. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, base 9.0) indicates a network-reachable, low-complexity attack by an already-authenticated low-privilege user, with a scope change reflecting that the attacker crosses an authorization boundary to reach other users' groups/data. The LDAP search-query injection yields privilege escalation, which maps cleanly to the full C:H/I:H/A:H impact. However, several exploitation-limiting conditions temper real-world risk: the issue only affects Homarr instances configured for LDAP authentication, and the attacker must already possess a valid user account (PR:L), so this is a post-authentication escalation, not an unauthenticated breach. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active or automated exploitation - the risk signal rests entirely on the vendor/GitHub advisory and the self-assessed severity. One discrepancy worth verifying with the vendor: the advisory assigns UI:R (user interaction required), yet the description portrays the attacker crafting and submitting malicious input themselves, which typically would not require separate victim interaction; this inflation/clarification does not change the overall high rating but should be confirmed.

A malicious user who already holds a low-privilege account on a Homarr instance configured with LDAP authentication submits a specially crafted input that is passed unsanitized into an LDAP search query. By manipulating the LDAP filter, the attacker escalates their privileges and gains access to groups belonging to other users, exposing their data and permissions. No public exploit code was identified in the provided data, so exploitation would currently require the attacker to develop the LDAP injection payload themselves.