GitHub Advisoryadvisory · Maven

GHSA-v53g-736w-mgw4 Liferay Portal's Organization Selector exposes organization data to remote authenticated users

MEDIUM Published 2025-09-12 Modified 2025-12-20 Official page ↗
Aliases
CVE-2025-43788
Ecosystem
Maven
Packages
com.liferay:com.liferay.organizations.item.selector.web
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-862
Reviewed
2025-09-15

Affected packages

• Maven com.liferay:com.liferay.organizations.item.selector.web: >= 4.0.2, < 4.0.22 → fixed in 4.0.22

Description

The Organization Selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1.12 and 7.4 update 81 through update 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.

Related

Alias · CVE (1)

  • CVE-2025-43788 The organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1.12 and 7.4 update 81 through… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References