CVE-2025-43790: Liferay Portal is vulnerable to Insecure Direct Object Reference (IDOR) attack through Authentication Bypass

The vulnerability is an Insecure Direct Object Reference (IDOR) within Liferay Portal, allowing authenticated users to access and manipulate data across different virtual instances. The root cause was a missing authorization check when handling object relationships.

The analysis of the provided commit 66b9a7dc4d40a10dec03e169ca8735add81e9bd9 clearly points to the vulnerable function. The patch modifies the RelationshipObjectFieldBusinessType.java file, specifically within the getValue method.

Before the fix, the getValue method would fetch an ObjectEntry based on a user-provided ID without verifying its parent ObjectDefinition. This meant a user from one virtual instance could reference an object in another instance by its ID, bypassing security boundaries. The patch introduces a crucial validation step: it compares the objectDefinitionId of the fetched object with the objectDefinitionId of the current context. If they do not match, it throws an ObjectEntryValuesException, effectively preventing the cross-instance data access.

Therefore, the com.liferay.object.internal.field.business.type.RelationshipObjectFieldBusinessType.getValue function is the precise location of the vulnerability. During exploitation, a runtime profiler would show this function being called as it processes the malicious request containing the ID of an object from another virtual instance.