Home

Description

Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote authenticated users in one virtual instance to assign an organization to a user in a different virtual instance via the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_addUserIds parameter.

PUBLISHED Reserved 2025-10-09 | Published 2025-10-13 | Updated 2025-10-14 | Assigner Liferay




MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-639 Authorization Bypass Through User-Controlled Key

Product status

Default status
unaffected

7.4.0
affected

Default status
unaffected

7.4.13
affected

2023.Q3.1
affected

2023.Q4.0
affected

Credits

foobar7 reporter

References

liferay.dev/...-/asset_publisher/jekt/content/CVE-2025-62252

cve.org (CVE-2025-62252)

nvd.nist.gov (CVE-2025-62252)

Download JSON