CVE-2025-43732: Insecure Direct Object Reference in com.liferay.roles.selector.web
Summary
CVE-2025-43732: Liferay Portal Vulnerable to Insecure Direct Object Reference. Affects com.liferay:com.liferay.roles.selector.web versions < 5.0.32. Fixed in 5.0.32. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package com.liferay.roles.selector.web is part of the Liferay Portal, a popular open-source platform for building web applications. This package specifically handles role selection functionalities within the portal, allowing administrators to manage user roles effectively. However, it has been identified to have a vulnerability that could lead to unauthorized access to sensitive user information.
Vulnerability Detail
Liferay Portal versions 7.4.0 through 7.4.3.132, and Liferay DXP versions 2025.Q1.0 through 2025.Q1.10, among others, are vulnerable to an Insecure Direct Object Reference (IDOR) in the groupId parameter of the _com_liferay_roles_selector_web_portlet_RolesSelectorPortlet_groupId. This vulnerability arises when an organization administrator modifies the groupId parameter, potentially allowing them to access user lists from other organizations without proper authorization. The implications of this vulnerability are significant, as it can lead to data breaches and unauthorized access to sensitive user information.
How To Fix
Minimum fixed version
5.0.32
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators should avoid modifying the groupId parameter directly until the package is updated to the patched version. Additionally, implementing strict access controls and monitoring can help mitigate the risk of unauthorized access.
Conclusion
The CVE-2025-43732 vulnerability in the com.liferay.roles.selector.web package poses a significant risk of unauthorized access to user information. It is crucial for organizations using affected versions to update to the patched version 5.0.32 and to implement temporary workarounds to mitigate risks until the update can be applied.
See every vulnerability recorded for com.liferay:com.liferay.roles.selector.web →
FAQ
CVE-2025-43732 is a vulnerability in the com.liferay.roles.selector.web package that allows unauthorized access to user lists due to an Insecure Direct Object Reference.
Liferay Portal versions 7.4.0 to 7.4.3.132 and Liferay DXP versions 2025.Q1.0 to 2025.Q1.10 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities by analyzing your pom.xml file. You can check your application using the Vulert playground without any signup.
The risks include unauthorized access to sensitive user information and potential data breaches, which can have serious implications for organizations.
If immediate updates are not possible, implement strict access controls and monitor for any unauthorized access attempts as a temporary measure.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
