CVE-2025-43732: 
Java vulnerability analysis and mitigation

CVE-2025-43732 is an Insecure Direct Object Reference (IDOR) vulnerability discovered in Liferay Portal and Liferay DXP systems. The vulnerability was disclosed on August 18, 2025, affecting multiple versions of Liferay Portal (7.4.0 through 7.4.3.132) and Liferay DXP versions from 2024.Q1 through 2025.Q1, including DXP 7.4 GA through update 92 (NVD, Liferay Security).

The vulnerability exists in the groupId parameter of the _com_liferay_roles_selector_web_portlet_RolesSelectorPortlet_groupId component. The CVSS v4.0 score is 4.8 (Medium) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) (NVD, Liferay Security).

When exploited, this vulnerability allows organization administrators to gain unauthorized access to user lists from other organizations by manipulating the groupId parameter value. This represents a significant breach of data access controls and organizational boundaries (Liferay Security).

The vulnerability has been fixed in multiple versions: Liferay Portal fixed on master branch, Liferay DXP 2025.Q2.0, Liferay DXP 2025.Q1.11, and Liferay DXP 2024.Q1.18. Organizations are advised to upgrade to these fixed versions to mitigate the vulnerability (Liferay Security).