CVE-2025-62243: Liferay DXP IDOR Auth Bypass Vulnerability

CVE-2025-62243 Overview

CVE-2025-62243 is an Insecure Direct Object Reference (IDOR) vulnerability in the Publications component of Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw allows remote authenticated attackers to view and edit publication comments they should not be able to access. Exploitation occurs by manipulating the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_value parameter in crafted URLs. The vulnerability is tracked under CWE-863: Incorrect Authorization.

Critical Impact

Authenticated attackers can read and modify publication comments belonging to other users, breaking confidentiality and integrity of change-tracking workflows in collaborative Liferay deployments.

Affected Products

• Liferay Portal 7.4.1 through 7.4.3.112
• Liferay DXP 2023.Q4.0 through 2023.Q4.5 and 2023.Q3.1 through 2023.Q3.8
• Liferay DXP 7.4 GA through update 92

Discovery Timeline

• 2025-10-13 - CVE-2025-62243 published to the National Vulnerability Database
• 2026-10-18 - Last updated in NVD database

Technical Details for CVE-2025-62243

Vulnerability Analysis

The vulnerability resides in the PublicationsPortlet component that manages the Publications change-tracking feature in Liferay. The portlet accepts a user-supplied object identifier through the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_value parameter. The server does not verify whether the authenticated session has permission to access or modify the referenced comment object. As a result, any logged-in user can request or alter comments attached to publications owned by other users or restricted workspaces. The flaw affects both read and write paths, enabling disclosure of draft content and tampering with review discussions tied to publication workflows.

Root Cause

The root cause is missing authorization enforcement on the comment handler, classified under CWE-863: Incorrect Authorization. The handler trusts the client-supplied object reference without checking it against the invoking user's permission set. This is a classic IDOR pattern in which object ownership and access rules are enforced only in the UI layer, not at the server-side portlet action.

Attack Vector

Exploitation requires network access to the Liferay instance and a valid, low-privilege account. An attacker enumerates or guesses the identifier of a target publication comment and submits a crafted request to the Publications portlet with the identifier placed in the vulnerable parameter. The server returns or updates the referenced comment without verifying ownership. No user interaction from the victim is required, and the attack can be scripted against ranges of identifiers. See the Liferay Security Advisory CVE-2025-62243 for vendor-confirmed technical details.

Detection Methods for CVE-2025-62243

Indicators of Compromise

• Access log entries containing the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_value parameter from accounts that do not own the referenced publication.
• Sequential or enumerated numeric values submitted to the Publications portlet from a single session, suggesting ID brute-forcing.
• Unexpected modifications to publication comments where the modifying user is not a listed collaborator on the publication.

Detection Strategies

• Correlate Liferay application logs with authentication context to flag users accessing publication comments outside their assigned workspace.
• Deploy web application firewall (WAF) rules that inspect PublicationsPortlet requests and compare the value parameter with session role mappings.
• Audit the Liferay ChangeTracking database tables for comment edit timestamps that do not match the expected author.

Monitoring Recommendations

• Enable verbose portlet action logging for the com.liferay.change.tracking.web module and ship logs to a centralized SIEM.
• Alert on bursts of HTTP requests to Publications endpoints from single accounts, particularly with varying value parameters.
• Track administrative review of publication comment histories as part of recurring access-control reviews.

How to Mitigate CVE-2025-62243

Immediate Actions Required

• Apply the fixes referenced in the Liferay Security Advisory CVE-2025-62243 to all affected Portal and DXP instances.
• Inventory accounts with access to Publications and revoke privileges for users who do not require change-tracking features.
• Review recent publication comment activity for unauthorized reads or edits during the exposure window.

Patch Information

Liferay has released fixes beyond the affected versions. Upgrade Liferay Portal past 7.4.3.112, and upgrade Liferay DXP past 2023.Q4.5, 2023.Q3.8, or 7.4 update 92 as appropriate. Consult the vendor advisory for the specific service pack or quarterly release containing the authorization check correction.

Workarounds

• Restrict access to the Publications feature through Liferay role configuration until the patch is applied.
• Place a reverse proxy or WAF rule in front of Liferay to block unauthenticated and low-trust requests to /o/change-tracking/ and PublicationsPortlet endpoints.
• Disable the Change Tracking module in environments that do not actively use publication workflows.

# Example WAF rule to flag suspicious Publications portlet access
# ModSecurity-style pseudo-rule
SecRule REQUEST_URI "@contains PublicationsPortlet" \
  "id:1062243,phase:2,log,deny,status:403,\
   chain,msg:'Potential CVE-2025-62243 IDOR attempt'"
  SecRule ARGS:_com_liferay_change_tracking_web_portlet_PublicationsPortlet_value \
    "@rx ^[0-9]+$" \
    "chain"
    SecRule REQUEST_HEADERS:Cookie "!@contains ROLE_PUBLICATIONS_ADMIN"