CVE-2025-62259
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Liferay Portal 7.4.0 through 7.4.3.109 and Liferay DXP in specified versions do not limit API access before a user has verified their email address. Remote users can access and edit content via the API without email verification.
Risk Assessment
An attacker could create an account with an unverified email and access the API to read or modify content, potentially compromising data integrity. The risk affects organizations using vulnerable Liferay versions.
Recommendation
Update Liferay Portal and Liferay DXP to versions containing the fix for CVE-2025-62259. Until updated, consider restricting API access for accounts with unverified email addresses.
Other vulnerabilities in Liferay Portal and Liferay DXP
See all- CVE-2025-43816High
A memory leak in the headless API for StructuredContents in Liferay Portal 7.4.0 through 7.4.3.119 and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2024.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows an attacker to cause server unavailability (denial of service) via repeatedly calling the API endpoint.
- CVE-2025-43790High
An Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.6, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote authenticated users from one virtual instance to access, create, edit, relate data/object entries/definitions to an object in a different virtual instance.
Original NVD description (English source)
Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has verified their email address, which allows remote users to access and edit content via the API.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS