Junglewise Threat Intelligence

CVE-2025-43790: Liferay Portal is vulnerable to Insecure Direct Object Reference (IDOR) attack through Authentication Bypass

CVE-2025-43790 · Severity: medium · CVSS 4 · Published 2025-09-11

Technologies: com.liferay:com.liferay.object.service (Maven). Vendors: Maven.

Executive brief

Liferay Portal is vulnerable to Insecure Direct Object Reference (IDOR) attack through Authentication Bypass

Affected products

Maven com.liferay:com.liferay.object.service

Related threats

Liferay Portal and DXP Instance Admin can execute code using Objects Actions and Validations
Liferay Portal is vulnerable to SSRF through custom object attachment fields