Moderate severityNVD Advisory· Published Aug 23, 2025· Updated Aug 25, 2025
CVE-2025-43768
CVE-2025-43768
Description
Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows authenticated users without any permissions to access sensitive information of admin users using JSONWS APIs.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.liferay.portal:com.liferay.portal.implMaven | < 108.1.1 | 108.1.1 |
Affected products
2- Liferay/DXPv5Range: 7.4.13
Patches
1efdbdbce7360LPD-41243 We need to check whether the user has permissions to assign members of the role instead
1 file changed · +1 −1
portal-impl/src/com/liferay/portal/service/impl/UserServiceImpl.java+1 −1 modified@@ -1500,7 +1500,7 @@ public int getOrganizationUsersCount(long organizationId, int status) @Override public long[] getRoleUserIds(long roleId) throws PortalException { RolePermissionUtil.check( - getPermissionChecker(), roleId, ActionKeys.VIEW); + getPermissionChecker(), roleId, ActionKeys.ASSIGN_MEMBERS); return userLocalService.getRoleUserIds(roleId); }
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- github.com/advisories/GHSA-cv9j-mg9w-v7wmghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-43768ghsaADVISORY
- github.com/liferay/liferay-portal/commit/efdbdbce73605ecd13b1a5e60f5186cc59f09c16ghsaWEB
- liferay.atlassian.net/browse/LPE-18154ghsaWEB
- liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43768ghsaWEB
News mentions
0No linked articles in our index yet.