Improper Access Vulnerability in Liferay Portal and DXP Products

CVE-2025-43773

What is CVE-2025-43773?

Liferay Portal and Liferay DXP products have a security vulnerability that allows for improper access through the expandoTableLocalService. This service, which facilitates advanced database operations, is incorrectly exposed within the Notifications Templates, leading to a lack of necessary permission checks. This oversight can potentially allow unauthorized users to access sensitive data or perform actions they should not be able to. Organizations using affected versions are strongly advised to review their configurations and apply necessary security patches.

References