CVE-2024-25604: Liferay Portal and DXP Vulnerability Allows Authenticated Users to Edit Permissions
Summary
CVE-2024-25604: Liferay Portal and Liferay DXP Allows Authenticated Users with View Permissions to Edit Permissions. Affects com.liferay.portal:release.portal.bom versions >= 7.2.0, < 7.4.3.5-ga5. Fixed in 7.4.3.5-ga5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a powerful open-source platform designed for building web applications and managing digital experiences. It provides a robust framework for content management, collaboration, and user engagement. Liferay DXP (Digital Experience Platform) extends these capabilities with additional features tailored for enterprise needs. However, certain versions of Liferay Portal and DXP are susceptible to a vulnerability that compromises user permission management, allowing unauthorized changes by authenticated users.
Vulnerability Detail
The vulnerability identified as CVE-2024-25604 affects Liferay Portal versions 7.2.0 through 7.4.3.4 and older unsupported versions, as well as Liferay DXP versions 7.4.13, 7.3 before service pack 3, and 7.2 before fix pack 17. It arises from improper checks on user permissions, enabling remote authenticated users with VIEW permissions to modify their own permissions through the User and Organizations section of the Control Panel. This flaw can lead to unauthorized privilege escalation, potentially allowing users to gain access to sensitive functionalities and data.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.4.3.5-ga5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the User and Organizations section of the Control Panel to only trusted administrators until the patch can be applied. This can be done by modifying user roles and permissions within the Liferay administration settings.
Conclusion
CVE-2024-25604 is a significant vulnerability affecting Liferay Portal and DXP, allowing unauthorized changes to user permissions. It is crucial for users of the affected versions to apply the necessary updates to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
CVE-2024-25604 is a vulnerability in Liferay Portal and DXP that allows authenticated users with VIEW permissions to edit their own permissions.
Liferay Portal versions 7.2.0 through 7.4.3.4 and older unsupported versions, as well as Liferay DXP versions 7.4.13, 7.3 before service pack 3, and 7.2 before fix pack 17 are affected.
The vulnerability can lead to unauthorized privilege escalation, allowing users to gain access to sensitive functionalities and data.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the pom.xml file. Visit Vulert Scanner to check your application without any signup.
The CVSS score for this vulnerability is 6.5, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
