CVE-2022-26595: 
Java vulnerability analysis and mitigation

Liferay Portal versions 7.3.7, 7.4.0, and 7.4.1 contain a security vulnerability identified as CVE-2022-26595. The vulnerability was discovered and disclosed in January 2022, affecting the user's site membership assignment UI functionality. This security flaw allows remote authenticated users to view sites/groups due to improper permission checking mechanisms (Liferay Advisory).

The vulnerability stems from improper permission validation when accessing lists of sites/groups through the user's site membership assignment UI. It has been assigned a CVSS v3.1 score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), indicating a relatively moderate severity level. The attack vector is network-based, requires low attack complexity, and needs low privileges to execute (Liferay Advisory).

The primary impact of this vulnerability is unauthorized access to site and group information. Authenticated users can view sites/groups that they shouldn't have permission to access, potentially leading to information disclosure (Liferay Advisory).

Liferay has addressed this vulnerability by releasing version 7.4.2 as a fix. For users running version 7.3.7, a source patch was made available in January 2022. Organizations are advised to upgrade to the fixed versions to mitigate this security risk (Liferay Advisory).