Back to feed
EUVD-2025-25726 · Published Aug 23, 2025
Liferay Portal JSONWS API endpoint shares sensitive information Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows authenticated users without any permissions to access sensitive information of admin users using JSONWS APIs.
Technologies
Liferay Liferay PortalLiferay Digital Experience Platform
Weaknesses
CWE-201
References
- https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43768
- https://nvd.nist.gov/vuln/detail/CVE-2025-43768
- https://github.com/liferay/liferay-portal/commit/efdbdbce73605ecd13b1a5e60f5186cc59f09c16
- https://github.com/liferay/liferay-portal
- https://liferay.atlassian.net/browse/LPE-18154
Potentially impacted assets
See if this affects your attack surface
