CVE-2025-43788

Published: Sep 12, 2025Modified: Jun 17, 2026

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security@liferay.com (Secondary)

Description

The organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1.12 and 7.4 update 81 through update 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.

Affected (8)

Products: Liferay: Digital Experience Platform, Liferay Portal

Liferay

2 products

Digital Experience Platform

Liferay Portal

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Liferay Digital Experience Platform	From 2024.Q1.1 to 2024.Q1.13
Liferay Digital Experience Platform	Version 7.4 update81
Liferay Digital Experience Platform	Version 7.4 update82
Liferay Digital Experience Platform	Version 7.4 update83
Liferay Digital Experience Platform	Version 7.4 update84
Liferay Digital Experience Platform	Version 7.4 update85
Liferay Liferay Portal	From 7.4.3.81 to 7.4.3.85
Liferay Liferay Portal	From 7.4.3.94 to 7.4.3.125

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (1)

https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43788

Source: security@liferay.com

Vendor Advisory

Timeline

No history available yet.