CVE-2025-62252: Liferay Portal Vulnerable to Authorization Bypass Through User-Controlled Key
Summary
CVE-2025-62252: Liferay is Vulnerable to Authorization Bypass Through User-Controlled Key. Affects com.liferay.portal:com.liferay.portal.impl versions < 99.0.0. Fixed in 99.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Liferay Portal is a popular open-source platform used for building web applications and managing digital experiences. It provides a robust set of features for user management, content management, and collaboration. However, certain versions of Liferay Portal and Liferay DXP have been found to be vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability, which can lead to unauthorized access and manipulation of user data across different virtual instances.
Vulnerability Detail
The vulnerability identified as CVE-2025-62252 allows remote authenticated users in one virtual instance of Liferay Portal to assign an organization to a user in a different virtual instance. This occurs through the manipulation of the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_addUserIds parameter. The issue arises from inadequate authorization checks, which can lead to unauthorized actions and potential data breaches.
How To Fix
Minimum fixed version
99.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can restrict access to the user management features or implement additional checks to validate user permissions before allowing actions that modify user associations across different virtual instances.
Conclusion
CVE-2025-62252 presents a significant security risk for users of Liferay Portal and Liferay DXP. It is crucial for organizations to update their installations to the latest patched version to protect against potential unauthorized access and data manipulation. Utilizing tools like Vulert can aid in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for com.liferay.portal:com.liferay.portal.impl →
FAQ
CVE-2025-62252 is a vulnerability in Liferay Portal that allows unauthorized users to manipulate user organization assignments across different virtual instances.
The vulnerability affects Liferay Portal versions 7.4.0 through 7.4.3.111, older unsupported versions, and Liferay DXP versions 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your pom.xml file to the Vulert playground, you can check for vulnerabilities without any signup.
If exploited, this vulnerability can lead to unauthorized access to user data, allowing attackers to manipulate user roles and organizations, which can compromise the integrity of the application.
Yes, a patch is available. Users should update to version 99.0.0 or later of the com.liferay.portal:com.liferay.portal.impl package to mitigate this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.liferay.portal:com.liferay.portal.impl.
