Critical · published August 29, 2025
⚠️ A little oversight could lead to big problems! Liferay Portal versions 7.4.0 to 7.4.3.132 have a vulnerability that allows improper access through the expandoTableLocalService. 🔍 Think of it as a hotel with a reception desk that mistakenly allows guests access to restricted areas without verifying their IDs — a simple miscommunication could let anyone stroll into the staff-only lounge. This issue means that an unauthorized user could gain access to sensitive data or features they shouldn't see, leading to potential data leaks or unintended actions being performed. While it's not a guaranteed exploit at this point, the risks of misuse are still there, and we must take them seriously!
Think of it as a hotel with a reception desk that mistakenly allows guests access to restricted areas without verifying their IDs — a simple miscommunication could let anyone stroll into the staff-only lounge. The vulnerability stems from the expandoTableLocalService not properly enforcing access controls, meaning users might be able to access or modify data that should be restricted.
This issue means that an unauthorized user could gain access to sensitive data or features they shouldn't see, leading to potential data leaks or unintended actions being performed. While it's not a guaranteed exploit at this point, the risks of misuse are still there, and we must take them seriously! To safeguard your system, update Liferay Portal to at least version 7.4.4 or a later patched version. Also, review your current access configurations to ensure proper security measures are in place. Don't forget to keep an eye on newer releases for ongoing updates! You've got this! By taking these steps, you can reinforce your defenses and keep your data secure. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| liferay/digital_experience_platform | ≥ 2024.Q1.1, < 2024.Q1.19 | 2024.Q1.19 |
| liferay/digital_experience_platform | ≥ 2024.q2.0, ≤ 2024.q2.13 | — |
| liferay/digital_experience_platform | ≥ 2024.Q3.0, ≤ 2024.Q3.13 | — |
| liferay/digital_experience_platform | ≥ 2024.q4.0, ≤ 2024.q4.7 | — |
| liferay/digital_experience_platform | ≥ 2025.Q1.0, < 2025.Q1.15 | 2025.Q1.15 |
| liferay/digital_experience_platform | all versions | — |
| liferay/digital_experience_platform | all versions | — |
| liferay/liferay_portal | ≥ 7.4.0, ≤ 7.4.3.132 | — |