CVE-2025-43797: Liferay DXP Auth Bypass Vulnerability

CVE-2025-43797 Overview

CVE-2025-43797 is an insecure default configuration vulnerability affecting Liferay Portal and Liferay Digital Experience Platform (DXP). Newly created sites default to an “Open” membership type, allowing any registered user to join without approval. Once joined, an authenticated remote attacker can view, add, or edit content on the affected site. The flaw maps to CWE-1188 (Insecure Default Initialization of Resource) and impacts Liferay Portal versions 7.1.0 through 7.4.3.111 and multiple DXP releases including 2023.Q4.0, 2023.Q3.1–7.3.4, 7.4 GA through update 92, and 7.3 GA through update 35.

Critical Impact
Any registered portal user can self-enroll into newly created sites and modify content, breaking tenant isolation on multi-site Liferay deployments.

Affected Products

Liferay Portal 7.1.0 through 7.4.3.111
Liferay DXP 7.3 GA through update 35 and 7.4 GA through update 92
Liferay DXP 2023.Q3.1 through 2023.Q3.4 and 2023.Q4.0

Discovery Timeline

2025-09-15 - CVE-2025-43797 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43797

Vulnerability Analysis

The vulnerability is a business-logic and secure-defaults flaw rather than a memory-safety or injection issue. Liferay Portal and DXP allow administrators to create sites with several membership types, including Open, Restricted, and Private. In affected versions, the platform selects “Open” as the default when a new site is provisioned. Any account holder on the portal can then join the site through the standard membership workflow without approval from a site administrator. Because Liferay grants site members baseline content permissions, a joined attacker inherits view, add, and edit rights on site assets such as pages, web content, and documents. The issue is severe in multi-tenant portals where sites are used to isolate departments, customers, or projects.

Root Cause

The root cause is an insecure default value in the site creation logic. Liferay ships with the Open membership type preselected instead of a least-privilege option such as Private or Restricted. Administrators who accept the default unknowingly expose the site to the entire authenticated user population. This matches the pattern described by CWE-1188, where a resource is initialized with permissions or settings that do not enforce least privilege.

Attack Vector

Exploitation requires only a valid, low-privileged Liferay account. The attacker authenticates to the portal, enumerates available sites through the standard site directory, and requests membership to any site left at the default type. Membership is granted immediately without administrator review. The attacker then interacts with site content using normal portal features. No custom exploit code is required, and there are no published proof-of-concept exploits at this time. See the Liferay Security Advisory CVE-2025-43797 for vendor guidance.

Detection Methods for CVE-2025-43797

Indicators of Compromise

Unexpected site membership grants for user accounts that have no business relationship with the site owner.
Content additions or edits performed by users who were never explicitly invited to a site.
Sites listed with membershipType=open in Liferay site configuration exports.

Detection Strategies

Audit the Site table in the Liferay database for entries where the membership type equals Open and correlate with unexpected membership growth.
Review Liferay audit logs for USER_SITE_MEMBERSHIP_ASSIGN events grouped by user to surface accounts joining unrelated sites.
Alert on content modification events (JournalArticle add/update, DLFileEntry add/update) authored by users whose membership was self-service.

Monitoring Recommendations

Forward Liferay application and audit logs to a centralized analytics platform and baseline normal site membership activity.
Monitor administrative UI actions for creation of new sites and flag those provisioned with Open membership for review.
Track privileged content changes on business-critical sites and require secondary review for edits made by recently joined members.

How to Mitigate CVE-2025-43797

Immediate Actions Required

Inventory all sites in each Liferay Portal or DXP instance and identify those configured with Open membership.
Change the membership type of sensitive sites to Private or Restricted and remove any unauthorized members.
Restrict site creation privileges to a small group of trained administrators until patched versions are deployed.

Patch Information

Liferay has published guidance in the Liferay Security Advisory CVE-2025-43797. Administrators should upgrade to a fixed Liferay Portal or DXP release as directed by the advisory, then verify that new sites default to a non-Open membership type.

Workarounds

Manually set the membership type to Restricted or Private each time a new site is created and validate the setting after creation.
Reduce the number of accounts that hold the site creation permission through Liferay role management.
Periodically export and review site membership rosters to detect self-enrollment on sensitive sites.

bash

# Configuration example: identify Open-membership sites via Liferay database query
# Run against the Liferay schema and review results before remediation
SELECT groupId, name, type_, membershipRestriction
FROM Group_
WHERE type_ = 1        -- site
  AND membershipRestriction = 0;  -- 0 = Open membership