CVE-2025-43784: Liferay DXP Auth Bypass Vulnerability

CVE-2025-43784 Overview

CVE-2025-43784 is an improper access control vulnerability [CWE-863] affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw resides in the API Builder component and allows unauthenticated guest users to obtain object entries information they should not have permission to view. Affected versions include Liferay Portal 7.4.0 through 7.4.3.124, Liferay DXP 2024.Q2.0 through 2024.Q2.8, DXP 2024.Q1.1 through 2024.Q1.12, and DXP 7.4 GA through update 92. Exploitation requires network access to the API Builder endpoints but does not require valid credentials.

Critical Impact
Guest users can retrieve sensitive object entry data through the Liferay API Builder, exposing information intended for authenticated users only.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.124
Liferay DXP 2024.Q2.0 through 2024.Q2.8 and 2024.Q1.1 through 2024.Q1.12
Liferay DXP 7.4 GA through update 92

Discovery Timeline

2025-09-10 - CVE-2025-43784 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43784

Vulnerability Analysis

The vulnerability is classified as an authorization flaw [CWE-863] in the Liferay API Builder. The API Builder allows administrators to define custom object types and expose them through REST endpoints. In the affected versions, the access control checks fail to properly validate guest user permissions against object entries. As a result, unauthenticated requests can return data records that should be gated by role-based permissions.

Because the attack surface is a network-accessible API, the flaw scales across any Liferay tenant exposing custom objects publicly. The confidentiality impact is limited to data reachable through the API Builder, but sensitive fields modeled as Liferay Objects, such as user submissions, business records, or internal catalogs, may be enumerated.

Root Cause

The root cause is missing or insufficient authorization enforcement on the object entry retrieval path within the API Builder. The vulnerable code paths return object entries without confirming that the requesting principal, in this case a guest, holds VIEW permission on the target object definition or its records.

Attack Vector

An attacker sends HTTP requests directly to the API Builder endpoints exposed by a vulnerable Liferay instance. No authentication is required beyond guest access, which is the default for anonymous visitors. The attacker enumerates object endpoints and reads entries that should be restricted. Full exploitation details are documented in the Liferay Security Advisory CVE-2025-43784.

Detection Methods for CVE-2025-43784

Indicators of Compromise

Unauthenticated HTTP requests to /o/c/* or other API Builder REST paths returning 200 OK with object entry payloads.
Spikes in guest-session traffic targeting object endpoints tied to internal or restricted object definitions.
Access log entries where the same client IP enumerates multiple object types in sequence.

Detection Strategies

Review Liferay access logs for anonymous requests to API Builder endpoints and correlate against the object definitions that should require authentication.
Compare object definition permission settings against actual response behavior by replaying guest requests against known-restricted objects.
Deploy web application firewall rules to flag unauthenticated access patterns against /o/c/ REST paths.

Monitoring Recommendations

Enable verbose logging on the Liferay Headless Delivery and Headless Admin APIs during incident response.
Alert on high-volume enumeration of object entry endpoints from a single source.
Monitor for outbound data volume anomalies from the Liferay application tier that could indicate bulk data extraction.

How to Mitigate CVE-2025-43784

Immediate Actions Required

Inventory all Liferay Portal and DXP instances and confirm version levels against the affected ranges.
Apply the fixed release identified in the Liferay Security Advisory CVE-2025-43784.
Audit object definitions created through the API Builder and confirm permission settings for the Guest role.

Patch Information

Liferay has published fixes as documented in the vendor advisory. Upgrade Liferay Portal 7.4 to a release later than 7.4.3.124, DXP 2024.Q2 beyond update 8, DXP 2024.Q1 beyond update 12, and DXP 7.4 beyond update 92. Refer to the Liferay Security Advisory CVE-2025-43784 for the exact fixed builds.

Workarounds

Remove VIEW permission from the Guest role on all custom object definitions until patches are applied.
Restrict network access to Liferay API Builder endpoints through a reverse proxy or WAF, requiring authenticated sessions.
Disable unused object definitions that expose data through the API Builder.

bash

# Example WAF rule to block anonymous access to Liferay Object API endpoints
# ModSecurity example - adjust to your environment
SecRule REQUEST_URI "@beginsWith /o/c/" \
  "id:1004378,\
   phase:1,\
   deny,\
   status:401,\
   msg:'Block unauthenticated access to Liferay API Builder',\
   chain"
  SecRule &REQUEST_HEADERS:Authorization "@eq 0" \
    "chain"
    SecRule &REQUEST_COOKIES:JSESSIONID "@eq 0"