CVE-2025-43784 Liferay Portal's Incorrect Authorization vulnerability can lead to guest users to obtaining sensitive data

Medium 6.2 Published 10 Sep 2025 Updated 10 Sep 2025

Guest users can access object entry information via the API Builder due to improper access control in Liferay Portal and DXP.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2025-43784?

CVE-2025-43784 is a medium-severity missing authorization vulnerability in Liferay Digital Experience Platform, published on 10 Sep 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows guest users to obtain object entries information via the API Builder.

Weakness: CWE-863

Which versions are affected by CVE-2025-43784?

2 open source packages ship an affected version, including com.liferay:com.liferay.headless.builder.impl. It affects 2 products.

Package	Affected	Fixed in
`com.liferay:com.liferay.headless.builder.impl` Maven	All versions	`1.0.32`
`com.liferay:com.liferay.headless.builder.impl` Maven	All versions	`1.0.32`

Products include Liferay Digital Experience Platform, Liferay Liferay Portal.

How do I fix CVE-2025-43784?

Upgrade com.liferay:com.liferay.headless.builder.impl to 1.0.32 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-43784 being exploited?

There is no known exploitation of CVE-2025-43784 in the wild and no public exploit code.

All Liferay Digital Experience Platform vulnerabilities

Sources

Also known as GHSA-fvp7-jj9m-3qpf.