What is GHSA-q86r-gwqc-jx85?

GHSA-q86r-gwqc-jx85 is a security advisory published by GitHub Security Advisories with Low severity. Liferay Portal JSON Web Services Direct Class Invocation Enables Service Access Policy Execution

Which CVE IDs does GHSA-q86r-gwqc-jx85 cover?

GHSA-q86r-gwqc-jx85 covers the following CVE IDs: CVE-2025-43789. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-q86r-gwqc-jx85?

GHSA-q86r-gwqc-jx85 affects 1 product, including: maven/com.liferay:com.liferay.comment.web:\u003e= 6.0.2, \u003c 6.1.4.

GHSA-q86r-gwqc-jx85Low

Liferay Portal JSON Web Services Direct Class Invocation Enables Service Access Policy Execution

Vendor

GitHub Security Advisories

Published

September 12, 2025

Last Modified

September 15, 2025

🔗 CVE IDs covered (1)

CVE-2025-43789 →

📋 Description

JSON Web Services in Liferay Portal 7.4.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.9, 7.4 GA through update 92 published to OSGi are registered and invoked directly as classes which allows Service Access Policies to get executed.

🎯 Affected products1

maven/com.liferay:com.liferay.comment.web:>= 6.0.2, < 6.1.4

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2025-43789
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43789
https://github.com/liferay/liferay-portal/commit/576039619a12f28304c5153ad3fa5e39f00548b3
https://github.com/liferay/liferay-portal/commit/cb349be999396e97883e5fa7ccf2d226737779ac
https://github.com/liferay/liferay-portal/commit/dfdd81d51808e38098e9a3250f3c8819e0761377
https://github.com/liferay/liferay-portal/commit/e91daba3736ea30674f0beb5f6622c6df057d18b
https://github.com/advisories/GHSA-q86r-gwqc-jx85