CVE-2024-26268: User Enumeration Vulnerability in Liferay Portal and Liferay DXP
Summary
CVE-2024-26268: Liferay Portal and Liferay DXP User Enumeration Vulnerability. Affects com.liferay.portal:release.portal.bom versions >= 7.2.0, < 7.4.3.27-ga27. Fixed in 7.4.3.27-ga27. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a powerful open-source platform designed for building web applications and managing digital experiences. It provides a robust set of features including content management, collaboration tools, and user management. Liferay DXP is the enterprise version that offers additional capabilities for businesses. Both platforms are widely used for their flexibility and scalability. However, a user enumeration vulnerability exists in specific versions, allowing attackers to determine if an account exists based on response times.
Vulnerability Detail
The user enumeration vulnerability in Liferay Portal and Liferay DXP arises from the way the application handles user authentication requests. Specifically, versions 7.2.0 through 7.4.3.26 of Liferay Portal and various versions of Liferay DXP are susceptible. Attackers can exploit this vulnerability by sending authentication requests and measuring the time it takes for the application to respond. If the response time differs significantly, it may indicate whether an account exists, leading to potential unauthorized access or account enumeration.
How To Fix
Latest published version: 7.4.3.132 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.4.3.27-ga27
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider implementing rate limiting on authentication requests to mitigate the risk of account enumeration. This can help prevent attackers from making multiple requests in a short period, thus reducing the effectiveness of timing attacks.
Conclusion
The user enumeration vulnerability in Liferay Portal and Liferay DXP poses a significant risk, allowing attackers to exploit response time discrepancies to determine account existence. It is crucial to update to the latest patched versions and implement additional security measures to protect your application.
See every vulnerability recorded for com.liferay.portal:release.portal.bom →
FAQ
CVE-2024-26268 is a user enumeration vulnerability found in specific versions of Liferay Portal and Liferay DXP, allowing attackers to determine if an account exists based on response times.
The vulnerability affects Liferay Portal versions 7.2.0 through 7.4.3.26 and Liferay DXP versions prior to the specified fixed updates.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your pom.xml file, you can check for vulnerabilities without needing to access the code.
Update your Liferay Portal or Liferay DXP to the latest patched versions as mentioned in the 'how to fix' section to mitigate the vulnerability.
The CVSS score for this vulnerability is 5.3, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:release.portal.bom.
