CVE-2025-43732 — Authorization Bypass Through User-Controlled Key in Digital Experience Platform

CWE-639 — Authorization Bypass Through User-Controlled Key4 documents4 sources

Severity

4.8MEDIUMNVD

EPSS

0.0%

top 86.72%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Liferay Digital Experience Platform Liferay DXP Liferay Portal +1 more

Timeline

PublishedAug 18

Description

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 is vulnerable to Insecure Direct Object Reference (IDOR) in the groupId parameter of the _com_liferay_roles_selector_web_portlet_RolesSelectorPortlet_groupId. When an organization administrator modifies this parameter id value, they can gain unauthorized access to us…

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Affected Packages4 packages

▶CVEListV5liferay/portal7.4.3.0 — 7.4.3.132

▶NVDliferay/liferay_portal7.4.0 — 7.4.3.132

▶NVDliferay/digital_experience_platform2024.Q1.1 — 2024.Q1.18+5

▶CVEListV5liferay/dxp7.4.13 — 7.4.13-u92+5

🔴Vulnerability Details

OSV

Liferay Portal Vulnerable to Insecure Direct Object Reference↗2025-08-18

▶

CVEList

CVE-2025-43732: Liferay Portal 7↗2025-08-18

▶

GHSA

Liferay Portal Vulnerable to Insecure Direct Object Reference↗2025-08-18

▶