CVE-2025-43789 LOW

CVE-2025-43789

Vendor Liferay
Product Portal
Weakness CWE-863 · Incorrect authorization
Published September 12, 2025
Last update September 12, 2025
View on NVD All CVEs

CVSS base score

1.0/10
Attack vector Adjacent
Attack complexity High
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92 published to OSGi are registered and invoked directly as classes which allows Service Access Policies get executed.

Key dates

02Disclosure timeline

September 12, 2025 CVE published
September 12, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-10908 Account Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized Access CVE-2020-15110 Possible pod name collisions in jupyterhub-kubespawner CVE-2023-32672 Apache Superset: SQL parser edge case bypasses data access authorization CVE-2026-22822 External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function CVE-2026-22784 Lychee cross-album password propagation on Album unlocking