CVE-2025-43806: Liferay DXP Authentication Bypass Vulnerability

CVE-2025-43806 Overview

CVE-2025-43806 is an authorization flaw in the Batch Engine component of Liferay Portal and Liferay Digital Experience Platform (DXP). The Batch Engine does not properly enforce permission checks on import and export tasks. Remote authenticated users can invoke the REST APIs to retrieve exported data belonging to other users or workspaces. The flaw is classified as [CWE-863: Incorrect Authorization]. Affected versions include Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP releases 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92.

Critical Impact
Authenticated users can access exported data through Batch Engine REST APIs without holding the required permissions, leading to confidentiality and integrity impact on portal data.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.112
Liferay DXP 2023.Q4.0 through 2023.Q4.7 and 2023.Q3.1 through 2023.Q3.10
Liferay DXP 7.4 GA through update 92

Discovery Timeline

2025-09-22 - CVE-2025-43806 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43806

Vulnerability Analysis

The Batch Engine module in Liferay Portal and DXP exposes REST APIs for importing and exporting portal content in bulk. These endpoints accept task identifiers and return the associated import or export payloads. The vulnerable code paths omit an authorization check that verifies whether the calling user owns the referenced batch task or holds the permission required to view its data. Any authenticated user with access to the REST layer can enumerate task identifiers and retrieve results generated by higher-privileged users. The exposure is limited to data handled through Batch Engine, which includes structured content, users, organizations, and other entities exported through the batch framework.

Root Cause

The root cause is missing permission validation in the Batch Engine service methods that back the import and export REST endpoints. The controllers rely on authentication alone and do not consult the portal permission checker before returning batch task results. This maps to [CWE-863: Incorrect Authorization], where an authorization decision is made without evaluating the identity of the requesting principal against the owning resource.

Attack Vector

Exploitation requires a valid Liferay account and network reachability to the portal's REST APIs. An attacker authenticates with low-privilege credentials, discovers or brute-forces batch task identifiers exposed by the Batch Engine endpoints, and issues authenticated HTTP requests to retrieve export results. No user interaction is required. Because the flaw is in the API layer, standard portal UI restrictions do not prevent direct API access. The vulnerability yields limited confidentiality and integrity impact per the CVSS 4.0 vector supplied by the vendor. Public proof-of-concept code is not available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Liferay Security Advisory CVE-2025-43806 for vendor-supplied technical details.

Detection Methods for CVE-2025-43806

Indicators of Compromise

Authenticated HTTP requests to /o/headless-batch-engine/ REST paths originating from accounts that do not normally use batch operations.
Repeated requests iterating over sequential or randomized batch task identifiers within a short time window.
Large response payloads returned to low-privileged users from export task endpoints.

Detection Strategies

Review Liferay access logs for GET requests against Batch Engine export endpoints correlated with the authenticated user's normal role assignments.
Enable audit logging on Batch Engine services and alert when a user retrieves export results for tasks they did not initiate.
Baseline expected Batch Engine API consumers, such as integration accounts, and treat calls from other identities as anomalous.

Monitoring Recommendations

Forward Liferay application and audit logs to a centralized analytics platform for retention and correlation with authentication events.
Monitor for spikes in Batch Engine API response sizes, which indicate bulk data retrieval.
Alert on authenticated REST access patterns that enumerate resource identifiers sequentially.

How to Mitigate CVE-2025-43806

Immediate Actions Required

Apply the fixed Liferay Portal or DXP release identified in the Liferay Security Advisory CVE-2025-43806.
Audit existing batch export tasks and rotate any credentials, tokens, or personal data that may have been exposed.
Restrict which roles are permitted to authenticate against the Batch Engine REST endpoints until patching is complete.

Patch Information

Liferay has published guidance for CVE-2025-43806 in its known vulnerabilities portal. Administrators should upgrade to a Liferay Portal build later than 7.4.3.112, or apply the corresponding DXP update newer than 2023.Q4.7, 2023.Q3.10, or 7.4 update 92. Refer to the vendor advisory for the exact fixed version mapped to your deployment channel.

Workarounds

Block or restrict network access to /o/headless-batch-engine/ endpoints at the reverse proxy or web application firewall until the patch is deployed.
Limit Batch Engine role assignments to a small, audited set of administrative service accounts.
Disable Batch Engine functionality in environments where import and export APIs are not required.

bash

# Example reverse proxy rule to restrict Batch Engine REST access to internal integration hosts
location /o/headless-batch-engine/ {
    allow 10.10.20.0/24;   # integration subnet
    deny  all;
    proxy_pass http://liferay_upstream;
}