Vulnerability Database

296,748

Total vulnerabilities in the database

CVE-2025-43784

Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows guest users to obtain object entry information via the API Builder.

Published: Sep 10, 2025
Updated: Sep 13, 2025
CVE: CVE-2025-43784
GHSA: GHSA-fvp7-jj9m-3qpf
Severity: Medium
Exploit:

No technical information available.

CWEs:

CWE-863

Affected Software
References

Software	From	Fixed in
com.liferay / com.liferay.headless.builder.impl	-	1.0.32

https://github.com/liferay/liferay-portal/commit/ccbae813d4a9ec66597191f58d1cb4137f264c99
https://liferay.atlassian.net/browse/LPE-18066
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43784

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo