CVE-2025-62252: 
Java vulnerability analysis and mitigation

CVE-2025-62252 is an Insecure Direct Object Reference (IDOR) vulnerability discovered in Liferay Portal and Liferay DXP. The vulnerability was first published on October 13, 2025, and affects multiple versions of Liferay Portal (7.4.0 through 7.4.3.111) and Liferay DXP (2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92) (NVD, Liferay Security).

The vulnerability allows remote authenticated users in one virtual instance to assign an organization to a user in a different virtual instance through the comliferayusersadminwebportletUsersAdminPortletaddUserIds parameter. The vulnerability has been assigned a CVSS v4.0 Base Score of 5.3 (Medium) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. The weakness has been categorized as CWE-639 (Authorization Bypass Through User-Controlled Key) (NVD).

The vulnerability allows unauthorized cross-instance organization assignments, potentially compromising the isolation between virtual instances and leading to unauthorized access control modifications (Liferay Security).

The vulnerability has been fixed in Liferay Portal version 7.4.3.112, Liferay DXP 2024.Q1.1, and Liferay DXP 2023.Q4.6. Users are advised to upgrade to these fixed versions to mitigate the vulnerability (Liferay Security).

The vulnerability was responsibly reported by security researcher foobar7 (Liferay Security).