Liferay Portal CVE-2025-62243

Exploitation requires a valid authenticated Liferay account (CVSS PR:L) with network access to the portal, and the target environment must use the Publications (change tracking) feature of Liferay Portal 7.4.1-7.4.3.112 or Liferay DXP 2023.Q4.0-2023.Q4.5, 2023.Q3.1-2023.Q3.8, or 7.4 GA through update 92. The concrete attack surface is the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_value parameter, which the portlet dereferences without a permission check. Limiting factors: no anonymous/unauthenticated path exists, impact is confined to viewing and editing publication comments (no code execution, no broader data access, no availability impact), and environments not using Publications are not exposed.

This is a moderate-severity broken-access-control flaw (CWE-863, improper authorization) that in real-world terms sits well below alarm level. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N) scores 5.3 and is internally consistent with the description: network-reachable, low complexity, but requiring an authenticated low-privilege account (PR:L) and yielding only low confidentiality and low integrity impact limited to publication comments - no availability impact and no scope change. The exploitation signals reinforce low urgency: EPSS is only 0.24% (14th percentile), there is no CISA KEV listing, and no public exploit code is referenced. No signals conflict in a way that raises priority - all available data (modest CVSS, low EPSS, no KEV, no POC) point the same direction. The one caveat is that the vendor-supplied 'Authentication Bypass' tag overstates the issue: this is an authorization/IDOR weakness exploitable only by already-authenticated users, not an authentication bypass. Net: a legitimate issue to patch during normal maintenance cycles, not an emergency; realistic risk is bounded to tampering with or reading comments by users who already hold valid portal accounts.

An authenticated low-privilege Liferay user manipulates the _com_liferay_change_tracking_web_portlet_PublicationsPortlet_value parameter in a crafted Publications URL to reference comment objects they should not be able to reach, then reads other users' publication comments and edits them because the portlet does not verify permissions. No public exploit code is referenced, but the attack is trivial to perform manually given a valid account and knowledge of the parameter. The network vector and low complexity (AV:N/AC:L) mean any logged-in user can attempt it directly against the portlet.