Insecure Direct Object Reference Vulnerability in Liferay Portal and DXP

CVE-2025-43810

What is CVE-2025-43810?

An Insecure Direct Object Reference (IDOR) vulnerability exists in Liferay Portal and Liferay DXP that allows remote authenticated users to add notes to commerce orders across different virtual instances. This security flaw is exposed through the parameter '_com_liferay_commerce_order_web_internal_portlet_CommerceOrderPortlet_commerceOrderId', which does not adequately enforce permissions, thereby enabling users to manipulate order notes that should be restricted.

References