GitHub Advisoryadvisory · Maven

GHSA-822f-jfpg-hg7h Liferay Portal and Liferay DXP fails to check permissions to view sites/groups

MEDIUM Published 2022-04-20 Modified 2025-07-14 Official page ↗
Aliases
CVE-2022-26595
Ecosystem
Maven
Packages
com.liferay.portal:release.portal.bom, com.liferay.portal:release.dxp.bom, com.liferay:com.liferay.site.browser.web, com.liferay.portal:com.liferay.portal.impl
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-276
Reviewed
2025-07-14

Affected packages

• Maven com.liferay.portal:release.portal.bom: 7.3.7 (no fix yet) • Maven com.liferay.portal:release.portal.bom: >= 7.4.0, < 7.4.2-ga3 → fixed in 7.4.2-ga3 • Maven com.liferay.portal:release.dxp.bom: >= 7.2.0, < 7.2.10.fp13 → fixed in 7.2.10.fp13 • Maven com.liferay.portal:release.dxp.bom: >= 7.3.0, < 7.3.10.fp2 → fixed in 7.3.10.fp2 • Maven com.liferay:com.liferay.site.browser.web: < 6.0.5 → fixed in 6.0.5 • Maven com.liferay.portal:com.liferay.portal.impl: < 7.7.9 → fixed in 7.7.9

Description

Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI.

Related

Alias · CVE (1)

  • CVE-2022-26595 Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when… vulnerability

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References