CVE-2025-62244: Liferay Change Tracking Web Package Vulnerable to Authorization Bypass
Summary
CVE-2025-62244: Liferay Publications vulnerable to Authorization Bypass Through User-Controlled Key. Affects com.liferay:com.liferay.change.tracking.web versions < 2.0.122. Fixed in 2.0.122. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Liferay Change Tracking Web package is part of the Liferay Portal, which is a platform for building web applications and managing content. This package specifically handles the publication of content and change tracking within the portal. It is widely used in enterprise environments for managing digital experiences. However, certain versions of this package are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability, which can expose sensitive information to unauthorized users.
Vulnerability Detail
The vulnerability arises from an insecure direct object reference (IDOR) in the Publications feature of Liferay Portal versions 7.3.1 through 7.4.3.111, and Liferay DXP versions 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92, and 7.3 GA through update 36. This flaw allows remote authenticated attackers to manipulate the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_ctCollectionId parameter to view the edit page of a publication, potentially leading to unauthorized access to sensitive content.
How To Fix
Minimum fixed version
2.0.122
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the Publications feature by implementing additional authorization checks in your application code to ensure that only authorized users can access sensitive publication data.
Conclusion
The CVE-2025-62244 vulnerability in the Liferay Change Tracking Web package poses a significant risk to applications using affected versions. It is crucial to update to the patched version and implement additional security measures to protect sensitive data.
See every vulnerability recorded for com.liferay:com.liferay.change.tracking.web →
FAQ
CVE-2025-62244 is a vulnerability in the Liferay Change Tracking Web package that allows unauthorized access to publication edit pages due to an insecure direct object reference.
The affected versions include Liferay Portal 7.3.1 through 7.4.3.111 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, among others.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
Update the Liferay Change Tracking Web package to version 2.0.122 or later to fix the vulnerability. Implement additional authorization checks as a temporary workaround.
If exploited, this vulnerability could allow attackers to view and edit sensitive publication content, leading to data breaches and unauthorized access.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay:com.liferay.change.tracking.web.
