Liferay DXP Authorization Bypass Through User-Controlled Key Vulnerability - CVE-2025-43782 - Vulnerability Database

Liferay DXP Authorization Bypass Through User-Controlled Key Vulnerability - CVE-2025-43782

Medium

Reference: CVE-2025-43782

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2025-43782

Title: Liferay DXP Authorization Bypass Through User-Controlled Key Vulnerability

Overview:

Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124 and Liferay DXP 2024.Q2.0 through 2024.Q2.7 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote authenticated users to access a workflow definition by name via the API