What is GHSA-5wxc-3jfw-w94p?

GHSA-5wxc-3jfw-w94p is a security advisory published by GitHub Security Advisories with High severity. Liferay Portal is vulnerable to Insecure Direct Object Reference (IDOR) attack through Authentication Bypass

Which CVE IDs does GHSA-5wxc-3jfw-w94p cover?

GHSA-5wxc-3jfw-w94p covers the following CVE IDs: CVE-2025-43790. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-5wxc-3jfw-w94p?

GHSA-5wxc-3jfw-w94p affects 1 product, including: maven/com.liferay:com.liferay.object.service:\u003c 1.0.197.

GHSA-5wxc-3jfw-w94pHigh

Liferay Portal is vulnerable to Insecure Direct Object Reference (IDOR) attack through Authentication Bypass

Vendor

GitHub Security Advisories

Published

September 11, 2025

Last Modified

December 20, 2025

🔗 CVE IDs covered (1)

CVE-2025-43790 →

📋 Description

An Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.6, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote authenticated users to from one virtual instance to access, create, edit, relate data/object entries/definitions to an object in a different virtual instance.

🎯 Affected products1

maven/com.liferay:com.liferay.object.service:< 1.0.197

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-43790
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43790
https://github.com/liferay/liferay-portal/commit/66b9a7dc4d40a10dec03e169ca8735add81e9bd9
https://liferay.atlassian.net/browse/LPE-18065
https://github.com/advisories/GHSA-5wxc-3jfw-w94p