GHSA-j4f7-gj7q-xg9m

Liferay has Incorrect Permission Assignment for Critical Resource

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-62251

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.liferay:com.liferay.site.navigation.menu.item.asset.vocabulary	< 1.0.23	1.0.23

Details

As written in the advisory (Markdown source, shown as plain text).

Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 and 7.3 GA though update 36 shows content to users who do not have permission to view it via the Menu Display Widget. This security flaw could result in sensitive information being exposed to unauthorized users.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-62251 advisory
https://github.com/liferay/liferay-portal/commit/12bec829da315c21fbc96492ffbdda4c7a2e59cb web
https://github.com/liferay/liferay-portal package
https://liferay.atlassian.net/browse/LPE-18236 web
https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62251 web