CVE-2025-62244: Liferay Publications vulnerable to Authorization Bypass Through User-Controlled Key

The vulnerability is an Insecure Direct Object Reference (IDOR) in the Liferay Portal's Publications feature, as described in CVE-2025-62244. An authenticated user could access the edit page of any publication by manipulating the ctCollectionId request parameter.

The root cause is the missing authorization check in the com.liferay.change.tracking.web.internal.portlet.action.EditCTCollectionMVCRenderCommand.render method. This method would fetch and prepare the publication for editing based solely on the user-provided ID, without verifying if the user had the rights to perform such an action.

The analysis of the provided patches, specifically commit 31cf99363bf615f4a3383ffcc78d800de3fa2465, confirms this. The patch introduces a permission check using _ctCollectionModelResourcePermission.check(...) within the render method to validate the user's UPDATE permissions before proceeding. This directly mitigates the IDOR vulnerability.

The com.liferay.change.tracking.web.internal.portlet.PublicationsPortlet.render method was also identified as relevant. It acts as the entry point for the portlet and its modification in the patch to handle security exceptions indicates it is part of the vulnerable execution path. When the vulnerability is exploited, a profiler would likely show PublicationsPortlet.render calling EditCTCollectionMVCRenderCommand.render, where the lack of permission checking occurs.