CVE-2025-62256 Liferay Portal and DXP do not properly restrict access to OpenAPI

Medium 6.9 Published 23 Oct 2025 Updated 23 Oct 2025

Remote attackers can access OpenAPI YAML files via crafted URLs due to improper access restrictions in Liferay Portal and DXP.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-62256?

CVE-2025-62256 is a medium-severity missing authorization vulnerability in Liferay Digital Experience Platform, published on 23 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not properly restrict access to OpenAPI in certain circumstances, which allows remote attackers to access the OpenAPI YAML file via a crafted URL.

Weakness: CWE-862

Which versions are affected by CVE-2025-62256?

2 open source packages ship an affected version, including com.liferay:com.liferay.portal.security.auth.verifier. It affects 2 products.

Package	Affected	Fixed in
`com.liferay:com.liferay.portal.security.auth.verifier` Maven	All versions	`6.0.26`
`com.liferay:com.liferay.portal.security.auth.verifier` Maven	All versions	`6.0.26`

Products include Liferay Digital Experience Platform, Liferay Liferay Portal.

How do I fix CVE-2025-62256?

Upgrade com.liferay:com.liferay.portal.security.auth.verifier to 6.0.26 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-62256 being exploited?

There is no known exploitation of CVE-2025-62256 in the wild and no public exploit code.

All Liferay Digital Experience Platform vulnerabilities

Sources

Also known as GHSA-j82q-c85j-xw4w.