CVE-2025-67493 is a high severity (CVSS 7.5) LDAP injection in Homarr, the open source dashboard. A signed in user can craft input that exposes other users group memberships. It affects only instances using LDAP authentication. Upgrade to Homarr 1.45.3 to fix it.
What's affected
Homarr versions before 1.45.3. The GitHub advisory lists the container image ghcr.io/homarr-labs/homarr at 1.45.2 and earlier as affected, with 1.45.3 and later patched. The record and the advisory agree on 7.5, high.
Only instances that use LDAP authentication are described as affected, and the advisory notes the actor needs access to a user account first. If you use local accounts or another sign in method, this particular flaw is not in your path, though upgrading is still sensible.
How to check if you're exposed
Find which image tag your deployment runs.
docker ps --format "table {{.Names}}\t{{.Image}}"
docker image inspect ghcr.io/homarr-labs/homarr:latest --format "{{.Id}}"
If you use Compose or Kubernetes, read the image tag in the manifest instead, since a floating tag hides the real version. Then confirm in the Homarr admin settings whether LDAP is the configured authentication provider. A running container's version is also visible in the application footer or about page.
What to do now
- Check whether any Homarr instance uses LDAP authentication.
- Update the image to 1.45.3 or later and recreate the container.
- Pin the image tag instead of using latest so you know what you run.
- Review group assignments inside Homarr for changes you did not make.
- If you cannot upgrade immediately, the advisory notes that disabling LDAP is the workaround, at the cost of LDAP logins.
Why it matters
The weaknesses are CWE-20, improper input validation, and CWE-90, LDAP injection. User supplied text was placed into an LDAP search filter without removing characters that have meaning to LDAP. A crafted value can change what the query matches.
The advisory describes two fixes: validate that input does not contain characters used in LDAP search queries, and check that only one user matches the query when looking up a user. The second change is a good defensive habit for any directory lookup. The record does not list this CVE as known exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
I do not use LDAP. Do I need to upgrade?
The flaw affects LDAP authentication. Upgrading is still reasonable, but the described exposure is limited to LDAP setups.
Can an anonymous visitor exploit it?
The advisory says the actor has access to a user account, so the starting point is a signed in user.
Sources
Last reviewed: 18 October 2026.
