CVE-2025-62252 Overview
CVE-2025-62252 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] affecting Liferay Portal and Liferay Digital Experience Platform (DXP). The flaw lets an authenticated user in one virtual instance assign an organization to a user in a different virtual instance. The abuse occurs through the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_addUserIds parameter, which fails to enforce proper tenancy isolation. The issue breaks the trust boundary between virtual instances, a core multi-tenancy feature in Liferay deployments.
Critical Impact
Authenticated attackers can cross virtual instance boundaries to manipulate organization membership of users belonging to other tenants, undermining multi-tenant isolation.
Affected Products
- Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions
- Liferay DXP 2023.Q4.0 through 2023.Q4.5, and 2023.Q3.1 through 2023.Q3.10
- Liferay DXP 7.4 GA through update 92, and older unsupported versions
Discovery Timeline
- 2025-10-13 - CVE-2025-62252 published to NVD
- 2026-10-18 - Last updated in NVD database
Technical Details for CVE-2025-62252
Vulnerability Analysis
Liferay supports multiple virtual instances within a single deployment, each representing a separate tenant with isolated users, sites, and organizations. The UsersAdminPortlet exposes an endpoint that accepts a list of user identifiers through the addUserIds parameter when assigning organizations. The portlet trusts the supplied identifiers without validating that each referenced user belongs to the caller's virtual instance. As a result, an authenticated administrator or user with organization-management privileges in one tenant can submit identifiers of users from another tenant and attach them to an organization they do not own.
Root Cause
The root cause is missing tenancy scope validation on the addUserIds input. The handler resolves user objects by primary key and performs organization assignment without comparing the target user's companyId to the acting user's companyId. This is a textbook IDOR pattern where object references from client input are used in server-side lookups without authorization checks tied to the requesting context.
Attack Vector
The attack is network accessible and requires low privileges on any single virtual instance. The attacker enumerates or guesses userId values belonging to foreign tenants and submits them in the _com_liferay_users_admin_web_portlet_UsersAdminPortlet_addUserIds parameter during an organization assignment action. No user interaction is required. The impact is limited to integrity of organization membership data; confidentiality and availability are not directly affected. Successful exploitation can be used to grant cross-tenant users access to sites, roles, or permissions inherited through organizations.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-62252
Indicators of Compromise
- Requests to UsersAdminPortlet actions containing addUserIds values whose underlying users belong to a companyId different from the authenticated session's companyId.
- Unexpected organization membership changes for users in virtual instances where the modifying administrator does not have an account.
- Audit log entries showing organization assignment events initiated from one virtual instance targeting user IDs owned by another.
Detection Strategies
- Enable Liferay audit logging for user and organization administration events and correlate userId values against their owning companyId.
- Deploy web application firewall (WAF) rules that inspect portlet action URLs for addUserIds parameters and flag high-volume or sequential ID submissions.
- Baseline normal cross-organization assignment activity per virtual instance and alert on deviations.
Monitoring Recommendations
- Forward Liferay application and access logs to a centralized SIEM for cross-tenant correlation.
- Monitor administrative portlets for authenticated users performing privileged actions outside of their normal working scope.
- Track changes to the Users_Orgs association table and alert on inserts that span companyId boundaries.
How to Mitigate CVE-2025-62252
Immediate Actions Required
- Upgrade Liferay Portal to a fixed release beyond 7.4.3.111 as published in the Liferay security advisory.
- Apply the latest service pack for Liferay DXP 2023.Q4, 2023.Q3, or 7.4 update stream according to vendor guidance.
- Review organization membership across all virtual instances for unauthorized cross-tenant assignments and revert as needed.
- Restrict access to the UsersAdminPortlet to the minimum set of trusted administrators per virtual instance.
Patch Information
Liferay has published remediation guidance in its security advisory. See the Liferay CVE-2025-62252 Vulnerability Details advisory for fixed versions and upgrade instructions covering both Liferay Portal 7.4 and Liferay DXP 2023.Q3, 2023.Q4, and 7.4 update streams.
Workarounds
- Limit organization administration permissions to a reduced set of accounts until patching is complete.
- Enforce WAF filtering of _com_liferay_users_admin_web_portlet_UsersAdminPortlet_addUserIds parameters that contain identifiers not associated with the caller's virtual instance.
- Increase audit log retention and review frequency for user and organization administration events during the exposure window.
# Example WAF rule concept (ModSecurity-style) - adapt to your environment
SecRule REQUEST_URI "@contains _com_liferay_users_admin_web_portlet_UsersAdminPortlet" \
"chain,phase:2,deny,status:403,id:1006225,\
msg:'Potential CVE-2025-62252 cross-instance IDOR attempt'"
SecRule ARGS_NAMES "@rx addUserIds" "t:none"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
