CVE-2025-62259
NoneLiferay Portal Does Not Limit Access to APIs Before Email Verification
CVSS
—
EPSS
0.2%
Published
Oct 28, 2025
CISA due date
—
The record
Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has verified their email address, which allows remote users to access and edit content via the API.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | com.liferay.portal:release.portal.bom | 7.4.0-ga1 | 7.4.3.110 |
| maven | com.liferay.portal/release.portal.bom | 7.4.0-ga1 | 7.4.3.110 |
Related vulnerabilities
- GHSA-gv7w-jh8g-vr73 Liferay Portal Does Not Limit Access to APIs Before Email Verification Same vulnerability
- CVE-2025-62264 Liferay Portal Vulnerable to Reflected XSS via the selectedLanguageId Parameter Also affects com.liferay.portal:release.portal.bom
- GHSA-56jv-4ww3-65mw Liferay Portal is vulnerable to XSS in the Blogs widget Also affects com.liferay.portal:release.portal.bom
- GHSA-f5vh-4rj2-w8r8 Liferay Portal is vulnerable to DNS rebinding attacks Also affects com.liferay.portal:release.portal.bom
- GHSA-8hw3-ghwv-crfh Liferay Portal vulnerable to password enumeration Also affects com.liferay.portal:release.portal.bom
- CVE-2025-62265 Liferay Portal is vulnerable to XSS in the Blogs widget Also affects com.liferay.portal:release.portal.bom
- CVE-2025-62266 Liferay Portal is vulnerable to DNS rebinding attacks Also affects com.liferay.portal:release.portal.bom
- CVE-2025-62257 Liferay Portal vulnerable to password enumeration Also affects com.liferay.portal:release.portal.bom