CVE-2025-43773 is a critical (CVSS 9.1) missing authorization flaw in Liferay Portal and Liferay DXP. Permission checks are absent in expandoTableLocalService, allowing improper access. The record lists affected Portal and DXP ranges but no fix, so take the fixed versions from the Liferay advisory for this CVE.
What's affected
The record lists Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18, and 7.4 GA through update 92.
Liferay's page for the CVE is titled Missing permission checks in expandoTableLocalService. The detail fields did not render when I fetched it, so I cannot quote fixed versions. Open the advisory and use the fixed release for your line.
Expando is Liferay's mechanism for adding custom fields to entities. The vulnerable service sits behind that feature, which many custom portals use heavily even if administrators rarely think about it.
How to check if you're exposed
Read the version of each instance in the control panel server information screen. For DXP, note both the quarter and the update number, then compare with the ranges above.
Review which custom fields your portal defines. If your developers rely on custom fields for sensitive data, the exposure is larger than for a portal that defines none.
Check your web logs for unexpected calls to the JSON web services or remote services that expose local service methods, and confirm that service access policies restrict anonymous callers.
What to do now
- List every Liferay instance and its exact version.
- Read Liferay's advisory for CVE-2025-43773 and select the fixed release for each line.
- Apply the update in a test environment and verify custom field behaviour, then deploy to production.
- Review service access policies and disable remote services that you do not use.
- Check custom field definitions for sensitive data and move anything critical behind explicit permission checks.
- Monitor access to administrative and service endpoints from outside your network.
Why it matters
The class is missing authorization, CWE-862 (Missing Authorization). A service method does the work without first checking whether the caller is allowed to ask for it. Anything that can reach the method can then use it, whatever the permissions model says elsewhere.
The vector lists network access, no privileges and no user interaction, with high confidentiality and integrity impact and no availability impact. Read that as data exposure and tampering rather than a crash. For a portal this can mean custom field data, which sometimes includes personal details.
The record does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. Missing checks in local services are easy to repeat across a codebase, so it is worth asking your vendor whether the fix is broader than the single method.
Quick check
Is this the same as the style books upload flaw?
No. CVE-2025-43766 is an unrestricted upload issue. This one is a missing permission check in a service. They affect overlapping releases, so one patch cycle can cover both, but confirm in each advisory.
Does it need credentials?
The vector says no privileges are required, which means an anonymous caller is the scoring case.
Sources
Last reviewed: 18 October 2026.
