Threat Investigation
Request a demo

CVE-2025-43788

Medium

Description

The organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1.12 and 7.4 update 81 through update 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.

SeverityMedium
CVSS4.3
Exploit probability—
ProductLiferay Portal
PublishedSep 12, 2025
First seenSep 12, 2025
Weakness typeCWE-862Missing authorization

How to fix

Update
  • liferay liferay_portal7.4.3.125 or later
  • liferay digital_experience_platform2024.Q1.13 or later
  • com.liferay:com.liferay.organizations.item.selector.web4.0.22 or later

Affected products

ProductAffected versionsFixed in
liferay liferay_portal7.4.3.81 ≤ v ≤ 7.4.3.85, 7.4.3.94 ≤ v < 7.4.3.1257.4.3.125
liferay digital_experience_platform2024.Q1.1 ≤ v < 2024.Q1.13, 7.42024.Q1.13
com.liferay:com.liferay.organizations.item.selector.webMaven4.0.2 ≤ v < 4.0.224.0.22

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.