A critical privilege escalation vulnerability in Homarr allows authenticated users to manipulate LDAP queries to gain unauthorized access to other user groups.

The application fails to properly sanitize input within LDAP search queries, which enables an authenticated user to perform LDAP injection. This flaw permits an attacker with an existing user account to escalate privileges and access unauthorized user groups.

The ability for a standard user to escalate privileges and access unauthorized groups poses a significant risk to data confidentiality and organizational integrity. Given the CVSS score of 7.5, this high-severity vulnerability could lead to widespread unauthorized access to sensitive dashboard resources and administrative functions.

Immediate Action: Update the Homarr dashboard to version 1.45.3 or later to incorporate the necessary input sanitization patches.

Proactive Monitoring: Review LDAP authentication logs and audit user group membership changes for anomalous activity or unexpected escalations.

Compensating Controls: If immediate patching is not feasible, restrict network access to the dashboard interface and monitor for unusual query patterns directed at the LDAP authentication backend.

Public Exploit Available: Unknown

This vulnerability represents a significant security risk for any deployment utilizing LDAP authentication. Administrators should prioritize updating their Homarr instances to version 1.45.3 immediately to neutralize the injection vector and prevent potential unauthorized access to sensitive user data.