N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-43782

CVE-2025-43782: Liferay Portal API Allows Authenticated Users to Access Workflow Definitions by Name

Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.7, 2024.Q1.1 through 2024.Q1.12, and 7.4 GA through update 92 allows remote authenticated users to access a workflow definition by name via the API.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-43782

CVE-2025-43782:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay:com.liferay.portal.workflow.kaleo.runtime.integration.impl	maven	>= 5.0.1, < 5.0.48	5.0.48

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2025-43782, is an Insecure Direct Object Reference (IDOR) in the Liferay Portal's workflow API. Authenticated users could access workflow definitions they were not authorized to view by referencing them by name. My analysis of the provided patches confirms this.

The patches consistently show a pattern of refactoring methods within WorkflowDefinitionManagerImpl. The original methods, such as getWorkflowDefinitions, getLatestWorkflowDefinition, and getWorkflowDefinition, directly called backend services (...Service classes) to fetch data. The vulnerability existed because these backend services did not correctly enforce permissions, allowing any authenticated user to retrieve data they shouldn't have access to.

The fix involved several key changes:

Introduction of liberal methods: New methods like liberalGetWorkflowDefinitions were added. These methods are intended for internal use where permission checks are not required, and they typically call ...LocalService classes, bypassing the remote permission checks.
Refactoring Original Methods: The original, vulnerable methods were changed to call new internal helper methods (e.g., _getWorkflowDefinitions). These helpers now contain the logic to call either the permission-checking remote service or the non-checking local service, based on a liberal boolean flag.
Updating Call Sites: Various parts of the Liferay codebase were updated to call the new liberal methods where appropriate, ensuring that internal features continue to work without being hindered by permission checks that shouldn't apply to them.

The identified vulnerable functions are the original implementations in WorkflowDefinitionManagerImpl that were exposed via the API and contained the flawed calls to the backend services. When this vulnerability is exploited, a runtime profiler would show these methods in the execution stack, as they are the entry point for processing the malicious request to access an unauthorized workflow definition.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.