CVE-2025-43799 Liferay Portal Uses Default Password

Medium 6.9 Published 15 Sep 2025 Updated 15 Sep 2025

Remote attackers can access and edit content via APIs before the user changes their initial password due to missing authorization checks.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-43799?

CVE-2025-43799 is a medium-severity missing authorization vulnerability in Liferay Digital Experience Platform, published on 15 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has changed their initial password, which allows remote users to access and edit content via the API.

Weakness: CWE-1393

Which versions are affected by CVE-2025-43799?

2 open source packages ship an affected version, including com.liferay.portal:release.portal.bom. It affects 2 products.

Package	Affected	Fixed in
`com.liferay.portal:release.portal.bom` Maven	From `7.4.0`	`7.4.3.112`
`com.liferay.portal:release.portal.bom` Maven	From `7.4.0`	`7.4.3.112`

Products include Liferay Digital Experience Platform, Liferay Liferay Portal.

How do I fix CVE-2025-43799?

Upgrade com.liferay.portal:release.portal.bom to 7.4.3.112 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-43799 being exploited?

There is no known exploitation of CVE-2025-43799 in the wild and no public exploit code.

All Liferay Digital Experience Platform vulnerabilities

Sources

Also known as GHSA-43xf-59vr-g4f2.