CVE-2025-43790 Overview
CVE-2025-43790 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw allows remote authenticated users in one virtual instance to access, create, edit, and relate data, object entries, and object definitions belonging to a different virtual instance. The vulnerability breaks the tenant isolation boundary that multi-instance Liferay deployments rely on to separate customer or business unit data.
Critical Impact
Authenticated attackers can cross virtual instance boundaries to read and manipulate object data belonging to other tenants, undermining multi-tenant data confidentiality and integrity.
Affected Products
- Liferay Portal 7.4.0 through 7.4.3.124
- Liferay DXP 2024.Q2.0 through 2024.Q2.6, and 2024.Q1.1 through 2024.Q1.12
- Liferay DXP 7.4 GA through update 92
Discovery Timeline
- 2025-09-11 - CVE-2025-43790 published to NVD
- 2025-12-16 - Last updated in NVD database
Technical Details for CVE-2025-43790
Vulnerability Analysis
Liferay supports virtual instances, a multi-tenant feature where a single Liferay deployment hosts multiple isolated portal instances. Each virtual instance maintains its own users, sites, content, and object definitions. The IDOR vulnerability breaks this isolation in the Object framework, which lets administrators model custom business data through user-defined object definitions and entries.
An authenticated user in virtual instance A can reference object identifiers belonging to virtual instance B and perform read, create, edit, and relate operations against them. The server fails to verify that the referenced object belongs to the requesting user's instance before authorizing the operation.
Root Cause
The root cause is missing tenant-scoped authorization on object framework endpoints. Code paths handling object entries, object definitions, and object relationships rely on the supplied identifier to locate the target resource but do not enforce that the resource's owning virtual instance matches the caller's session context. This is the canonical pattern described by CWE-639: Authorization Bypass Through User-Controlled Key.
Attack Vector
Exploitation requires network access to the Liferay portal and a valid low-privilege account in any virtual instance. The attacker submits API or portlet requests referencing object IDs from a target instance. Because the request originates from an authenticated session, the server processes the cross-tenant operation. User interaction is required as the attack relies on a victim instance hosting the referenced objects.
No public proof-of-concept code is available. Refer to the Liferay CVE-2025-43790 Advisory for vendor-provided details.
Detection Methods for CVE-2025-43790
Indicators of Compromise
- Application log entries showing object framework API calls (/o/c/, /o/object-admin/) where the authenticated user's companyId does not match the target object's companyId.
- Unexpected creation, modification, or relationship changes on object entries by accounts that have no business role in the owning virtual instance.
- Sequential or enumerated object ID access patterns from a single authenticated session.
Detection Strategies
- Audit Liferay access logs for cross-instance object API requests by correlating session companyId with the companyId of the affected object record.
- Enable Liferay audit logging on object definition and object entry events, then alert on operations performed by users outside the object's owning instance.
- Review database tables backing object entries for recent writes attributable to users from other virtual instances.
Monitoring Recommendations
- Forward Liferay application and audit logs to a centralized log platform with retention sufficient for incident reconstruction.
- Baseline normal object framework usage per virtual instance and alert on volume spikes or off-hours activity.
- Monitor authentication events for low-privilege accounts that suddenly enumerate object IDs across wide numeric ranges.
How to Mitigate CVE-2025-43790
Immediate Actions Required
- Upgrade Liferay Portal to a fixed release beyond 7.4.3.124 and Liferay DXP to a release beyond 2024.Q2.6, 2024.Q1.12, or 7.4 update 92 as applicable.
- Inventory all virtual instances and review object definitions and entries for unauthorized modifications since deployment of the affected version.
- Restrict object framework permissions to the minimum set of roles required for business operations.
Patch Information
Liferay has published the fix and version guidance in the Liferay CVE-2025-43790 Advisory. Customers on Liferay DXP subscription channels should apply the latest quarterly release or service pack. Self-hosted Liferay Portal Community Edition users should upgrade to the latest 7.4 maintenance release containing the fix.
Workarounds
- Limit network exposure of the Liferay portal so only trusted authenticated users can reach object framework endpoints.
- Reduce or remove the ability for standard users to invoke object APIs by adjusting role-based permissions on object definitions.
- Where multi-tenant isolation is critical, deploy separate Liferay clusters per tenant rather than relying on virtual instances until patched.
# Example: review object API access by user and target companyId
grep -E "/o/(c|object-admin)/" /opt/liferay/logs/access.log \
| awk '{print $1, $7, $9}' \
| sort | uniq -c | sort -rn | head -50
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
