Home

Description

Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has verified their email address, which allows remote users to access and edit content via the API.

PUBLISHED Reserved 2025-10-09 | Published 2025-10-27 | Updated 2025-10-28 | Assigner Liferay




MEDIUM: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-863 Incorrect Authorization

Product status

Default status
unaffected

7.4.0 (maven)
affected

Default status
unaffected

7.3.10 (maven)
affected

7.4.13 (maven)
affected

2023.Q3.1 (maven)
affected

Credits

4rth4s reporter

References

liferay.dev/...-/asset_publisher/jekt/content/CVE-2025-62259

cve.org (CVE-2025-62259)

nvd.nist.gov (CVE-2025-62259)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.