VYPR
Get started
← All advisories
Low severityNVD Advisory· Published Oct 22, 2025· Updated Oct 23, 2025

CVE-2025-62247

CVE-2025-62247

Description

Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 allows instance users to read and select unauthorized Blueprints through the Collection Providers across instances.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.liferay:com.liferay.search.experiences.serviceMaven
<= 3.0.84—

Affected products

2

Patches

1
019d703943ef

LPD-61237 search-experiences-service: Collection Providers are only available in their instances

https://github.com/liferay/liferay-portalJoshua CordsJul 18, 2025via ghsa
commit
1 file changed · +9 −1
  • modules/dxp/apps/search-experiences/search-experiences-service/src/main/java/com/liferay/search/experiences/internal/info/collection/provider/SXPBlueprintInfoCollectionProvider.java+9 −1 modified
    @@ -17,6 +17,7 @@
 import com.liferay.petra.string.StringBundler;
 import com.liferay.petra.string.StringPool;
 import com.liferay.portal.kernel.feature.flag.FeatureFlagManagerUtil;
+import com.liferay.portal.kernel.security.auth.CompanyThreadLocal;
 import com.liferay.portal.kernel.service.ServiceContext;
 import com.liferay.portal.kernel.service.ServiceContextThreadLocal;
 import com.liferay.portal.kernel.theme.ThemeDisplay;
@@ -89,7 +90,14 @@ public List<InfoFilter> getSupportedInfoFilters() {
 
 	@Override
 	public boolean isAvailable() {
-		return FeatureFlagManagerUtil.isEnabled("LPS-129412");
+		if (FeatureFlagManagerUtil.isEnabled("LPS-129412") &&
+			(sxpBlueprint.getCompanyId() ==
+				CompanyThreadLocal.getCompanyId())) {
+
+			return true;
+		}
+
+		return false;
 	}
 
 	protected SearchRequestBuilder getSearchRequestBuilder(

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.