CVE-2025-62251: Liferay has Incorrect Permission Assignment for Critical Resource

The vulnerability lies in an incorrect permission assignment, allowing unauthorized users to view content via the Menu Display Widget. The analysis of the provided patch (commit 12bec829da315c21fbc96492ffbdda4c7a2e59cb) reveals that the fix was to implement a missing hasPermission method in the AssetVocabularySiteNavigationMenuItemType class. The commit message, "Implements the permission checking for the asset vocabulary site navigation items," confirms that a permission check was previously absent. Before the patch, when the Menu Display Widget was rendered, the framework would call the hasPermission method on the menu item type. Since AssetVocabularySiteNavigationMenuItemType did not have its own implementation, a default, permissive version from a parent interface was used, leading to the vulnerability. A runtime profiler would show a call to hasPermission on an instance of AssetVocabularySiteNavigationMenuItemType during the menu rendering process. Therefore, this function is identified as the key indicator of the vulnerability being triggered.