Improper Access Control in Liferay Portal and DXP Products by Liferay
CVE-2025-43788

5.3MEDIUM

Key Information:

Vendor

Liferay
Status
Portal
Dxp
Vendor
CVE Published:
12 September 2025

What is CVE-2025-43788?

A security vulnerability in Liferay Portal versions 7.4.0 to 7.4.3.124 and Liferay DXP 2024.Q1.1 to 2024.Q1.12 allows remote authenticated users to bypass user permission checks. This flaw enables these users to view a complete list of all organizations registered within the system without appropriate authorization, potentially leading to unauthorized access to sensitive organizational information.

Affected Version(s)

DXP 7.4.13-u81 <= 7.4.13-u85

DXP 2024.Q1.1 <= 2024.Q1.12

Portal 7.4.3.94 <= 7.4.3.124

References

https://liferay.dev/portal/security/known-vulnerabilities...

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.