CVE-2025-43827: Liferay DXP IDOR Information Disclosure

CVE-2025-43827 Overview

CVE-2025-43827 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw resides in the audit events functionality exposed through the AuditPortlet. Authenticated users in one virtual instance can read audit events belonging to a different virtual instance by manipulating the _com_liferay_portal_security_audit_web_portlet_AuditPortlet_auditEventId parameter. The vulnerability breaks the multi-tenancy isolation model that Liferay virtual instances are expected to enforce.

Critical Impact
Authenticated users can bypass virtual instance isolation and view audit events from other tenants, exposing sensitive security and administrative activity logs across tenant boundaries.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.117 (and older unsupported versions)
Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10
Liferay DXP 7.4 GA through update 92 (and older unsupported versions)

Discovery Timeline

2025-09-30 - CVE-2025-43827 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-43827

Vulnerability Analysis

Liferay supports multi-tenancy through virtual instances, where each instance is intended to maintain isolated users, content, and audit trails. The audit events feature in the portal security module exposes auditEventId as a user-controllable request parameter via the AuditPortlet. The portlet retrieves the referenced audit event without validating that the record belongs to the requesting user's virtual instance.

An authenticated attacker on one virtual instance can enumerate or guess numeric auditEventId values and retrieve audit entries created in other virtual instances. Audit events typically contain usernames, IP addresses, timestamps, action types, and resource identifiers. Exposure of this telemetry across tenants undermines the confidentiality guarantees of the shared Liferay deployment and can support reconnaissance for follow-on attacks.

Root Cause

The root cause is missing authorization on the auditEventId parameter in the AuditPortlet request handler. The code performs object retrieval by identifier without verifying that the audit record's owning virtual instance matches the active session's virtual instance. This matches the [CWE-639] pattern: authorization is based on authentication alone rather than on the relationship between the authenticated principal and the requested resource.

Attack Vector

Exploitation requires network access to the Liferay instance and valid authenticated credentials on any virtual instance. The attacker issues a crafted request to the audit portlet URL and supplies an auditEventId value tied to a different virtual instance. No user interaction, elevated privileges, or specialized tooling is required beyond a standard HTTP client. The attack scales trivially by iterating identifier values to harvest cross-tenant audit data.

See the Liferay Security Advisory CVE-2025-43827 for vendor-provided technical details.

Detection Methods for CVE-2025-43827

Indicators of Compromise

Requests to URLs containing the _com_liferay_portal_security_audit_web_portlet_AuditPortlet_auditEventId parameter from authenticated accounts that do not normally interact with the audit console.
Sequential or enumerated numeric values supplied for auditEventId within short time windows, indicating automated harvesting.
Access to the audit portlet by non-administrative user accounts.

Detection Strategies

Review Liferay access logs for requests to the AuditPortlet endpoint and correlate the requesting user's virtual instance with the virtual instance that owns each retrieved auditEventId.
Alert on authenticated sessions issuing high-volume requests to audit-related portlet URLs.
Baseline normal audit console usage per virtual instance and flag deviations.

Monitoring Recommendations

Forward Liferay application logs and web server access logs to a centralized analytics platform for cross-tenant correlation.
Monitor failed and successful authorization decisions on audit event retrieval after patches are applied.
Track administrative account activity on virtual instances to identify anomalous access to security logging features.

How to Mitigate CVE-2025-43827

Immediate Actions Required

Upgrade Liferay Portal to a fixed release beyond 7.4.3.117 and Liferay DXP to the vendor-recommended patched update level per the Liferay advisory.
Audit existing virtual instance user accounts and remove unused or unnecessary accounts that could be leveraged to reach the audit portlet.
Review historical access logs for prior exploitation attempts against the AuditPortlet endpoint.

Patch Information

Liferay has published fixes referenced in the Liferay Security Advisory CVE-2025-43827. Administrators running unsupported versions should upgrade to a supported branch, since those releases will not receive backported fixes. Confirm the applied update level against the ranges listed in the advisory for both Liferay Portal 7.4 and Liferay DXP 2023.Q3, 2023.Q4, and 2024.Q1 streams.

Workarounds

Restrict access to the audit portlet to administrative roles only at the web server or reverse proxy layer until patches are deployed.
Block or filter requests containing the _com_liferay_portal_security_audit_web_portlet_AuditPortlet_auditEventId parameter from untrusted or non-administrative users.
Reduce the number of authenticated low-privilege accounts able to reach any virtual instance of the affected deployment.

bash

# Example reverse proxy restriction (nginx) limiting audit portlet access by source
location ~* _com_liferay_portal_security_audit_web_portlet_AuditPortlet {
    allow 10.0.0.0/24;   # administrative network
    deny all;
    proxy_pass http://liferay_backend;
}