CVE-2025-62259: Liferay DXP Auth Bypass Vulnerability

CVE-2025-62259 Overview

CVE-2025-62259 is an authorization flaw in Liferay Portal and Liferay Digital Experience Platform (DXP). The application does not restrict API access for users who have not yet verified their email address. Remote users can therefore access and edit content through the API before completing the account verification step required by the platform.

The vulnerability is classified under CWE-863: Incorrect Authorization. It affects Liferay Portal versions 7.4.0 through 7.4.3.109 and multiple Liferay DXP release trains, including 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35.

Critical Impact
Unverified accounts can invoke Liferay APIs to read and modify portal content, bypassing the email verification control designed to gate API access.

Affected Products

Liferay Portal 7.4.0 through 7.4.3.109 and older unsupported versions
Liferay DXP 2023.Q3.1 through 2023.Q3.4
Liferay DXP 7.4 GA through update 92 and 7.3 GA through update 35

Discovery Timeline

2025-10-27 - CVE-2025-62259 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62259

Vulnerability Analysis

Liferay Portal and DXP implement an email verification workflow for new accounts. This step is intended to confirm ownership of an address before the account can act on portal resources. The API layer, however, does not enforce that verification state consistently. An account that has registered but not yet clicked the confirmation link can still authenticate against API endpoints and perform content operations.

Because the missing check sits in the authorization layer, both read and write operations are exposed. Attackers can enumerate content, create or modify assets, and interact with portal objects that should require a fully verified identity. The issue is reachable over the network without user interaction, which makes automated abuse straightforward against internet-facing Liferay instances.

Root Cause

The root cause is an incorrect authorization decision in Liferay's API access controls. Verification state is a required precondition for content APIs, but the code path that dispatches API requests does not evaluate the email verification flag. Authorization is granted based on authentication alone, which violates the platform's intended trust model.

Attack Vector

The attack is network-based and requires only the ability to register or control an unverified account. After obtaining API credentials or session tokens, the attacker calls Liferay REST or headless APIs directly. No privileged role, elevated permission, or victim interaction is needed. See the Liferay Security Advisory for CVE-2025-62259 for vendor-supplied technical details.

Detection Methods for CVE-2025-62259

Indicators of Compromise

API requests to Liferay headless or JSON web service endpoints originating from accounts whose emailAddressVerified attribute is false.
Content creation, modification, or deletion events attributed to newly registered accounts within minutes of registration.
Bursts of registrations from disposable email domains followed immediately by API traffic.

Detection Strategies

Review Liferay audit logs and correlate User_ records with API access logs to flag activity by unverified accounts.
Inspect access logs for high-volume calls to /o/headless-* and /api/jsonws/* paths from recently created users.
Add web application firewall rules that inspect the session's verification claim before permitting API calls to content endpoints.

Monitoring Recommendations

Alert on any write operation performed by an account created in the last 24 hours that has not completed email verification.
Track anomalies in Liferay's Audit event stream for USER_ADD followed by ARTICLE_ADD or DLFileEntry changes without an interim USER_EMAIL_ADDRESS_VERIFIED event.
Forward Liferay application, access, and audit logs to a centralized analytics platform for correlation with authentication telemetry.

How to Mitigate CVE-2025-62259

Immediate Actions Required

Apply the Liferay security update referenced in the vendor advisory to all Portal and DXP instances in scope.
Audit existing user accounts and disable or purge accounts that remain unverified beyond a defined threshold.
Restrict self-registration on internet-facing portals until the patch is deployed.

Patch Information

Liferay has published fixed builds for the affected Portal and DXP branches. Customers on 7.4 GA through update 92 and 7.3 GA through update 35 should upgrade to the latest DXP update or quarterly release that includes the fix. Refer to the Liferay Security Advisory CVE-2025-62259 for the specific fixed versions and download instructions.

Workarounds

Set company.security.strangers.verify=true and require administrator approval before new users can authenticate.
Disable open user registration by setting company.security.strangers=false in portal-ext.properties until the patch can be deployed.
Place Liferay API endpoints behind an authenticating reverse proxy or WAF policy that blocks requests from sessions lacking a verified email claim.

bash

# Configuration example: harden portal-ext.properties
company.security.strangers=false
company.security.strangers.verify=true
company.security.strangers.with.mx=false
users.email.address.required=true