Insecure Direct Object Reference in Liferay Portal and DXP by Liferay

CVE-2025-43782

What is CVE-2025-43782?

An Insecure Direct Object Reference (IDOR) vulnerability exists in Liferay Portal versions 7.4.0 to 7.4.3.124 and Liferay DXP across multiple versions. This flaw allows remote authenticated users to exploit the API to gain unauthorized access to sensitive workflow definitions by name. Implementing proper access controls is crucial to mitigate this issue, as it poses a risk of information leakage and unauthorized action within the application.

References