API Access Vulnerability in Liferay Portal and DXP Products

CVE-2025-43799

What is CVE-2025-43799?

An vulnerability exists in Liferay Portal and Liferay DXP that permits remote users to access and manipulate content through the API. This issue arises because the affected versions do not enforce necessary restrictions on API access, particularly before users have changed their initial passwords. As a result, unauthorized parties may exploit this flaw to gain access to sensitive data and alter content without proper authentication. It is essential for users and administrators of affected Liferay products to update to the latest versions and implement necessary security measures to mitigate the risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References