Insecure Direct Object Reference in Liferay Portal by Liferay

CVE-2025-43732

What is CVE-2025-43732?

The vulnerability identified in Liferay Portal and Liferay DXP enables unauthorized access to user lists from different organizations due to an Insecure Direct Object Reference in the groupId parameter of the roles selector portlet. Administrators manipulating this parameter can inadvertently expose sensitive user information, highlighting the need for strict access controls and secure coding practices.

References