Liferay Portal CVE-2025-62260

Requires (1) an authenticated low-privilege Liferay account per CVSS PR:L - exploitation is not possible unauthenticated, so environments with open self-registration or broadly issued accounts are at materially higher risk; and (2) network reachability to the Liferay Headless (REST/GraphQL) API endpoints, which must be exposed to the attacker. The specific flaw is the absence of a server-side limit on the number of objects returned by Headless API collection requests, so the condition is simply the ability to issue a query that resolves to a large object set. Limiting factors: valid credentials are mandatory, impact is availability-only (no data disclosure or modification), and affected versions are Liferay Portal 7.4.0-7.4.3.99 and DXP 2023.Q3.1-2023.Q3.4, 7.4 GA-update 92, and 7.3 GA-update 35 (and older unsupported releases).

This is a moderate-priority availability issue, not a critical emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) scores 7.1 (HIGH) but the impact is purely availability - no confidentiality or integrity exposure (VC:N/VI:N) - reflecting CWE-400 uncontrolled resource consumption. Crucially, PR:L means exploitation requires an authenticated low-privilege account, which meaningfully raises the bar versus an unauthenticated internet-facing flaw. The EPSS score is low (0.39%, 31st percentile), consistent with a resource-exhaustion DoS that lacks the mass-exploitation appeal of RCE. There is no CISA KEV listing and no public exploit identified, so all signals align: this is a genuine but non-urgent HIGH, driven by a high CVSS availability sub-score rather than real-world weaponization. Signals are internally consistent - no contradictions between the vector, EPSS, and exploitation status. Prioritize patching for internet-exposed Liferay instances where low-privilege accounts are broadly provisioned (e.g., self-registration enabled), but it ranks below any authenticated-RCE or unauthenticated flaw in the same environment.

An attacker holding a valid low-privilege Liferay account (or one obtained via open self-registration) issues a single Headless REST/GraphQL API request that enumerates an unbounded collection of objects. Because the API applies no server-side cap on the number of objects returned, the response assembly exhausts memory/CPU, degrading or crashing the portal for all users. No public exploit code has been identified, but the attack requires only a crafted HTTP request with low complexity (AC:L).