CVE-2025-62242: Liferay Account Admin Web vulnerable to Authorization Bypass Through User-Controlled Key

The analysis of the provided patches reveals vulnerabilities within the com.liferay.change.tracking.web module, specifically in the UpdateCTCommentMVCResourceCommand.doServeResource method. The patches fix both a CSRF vulnerability and an improper access control issue. It is important to note that the provided CVE description refers to an Insecure Direct Object Reference (IDOR) vulnerability in a different module (com.liferay.account.admin.web) and is associated with a different internal issue tracker ID (LPE-17932 vs. LPD-15347 in the commits). Therefore, the identified vulnerable function and the reasoning are based strictly on the provided commit data, which appears to be for a different vulnerability than the one described in the CVE title and description. The root cause of the vulnerability fixed by the patches is a combination of missing CSRF protection and inadequate permission checks, allowing unauthorized modification of data.