Read the docs
TI-2022-09893 Aliases CVE-2022-26595GHSA-822f-jfpg-hg7h

Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack…

Priority LOW 21CWE-276Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI.

Why it matters now

EPSS 0.00746 55th percentileScored 2026-11-07
Fix Fixed com.liferay.portal:release.portal.bom (Maven): 7.4.2-ga3com.liferay.portal:release.dxp.bom (Maven): 7.2.10.fp13, 7.3.10.fp2+2 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.liferay.portal:release.portal.bom (Maven)——No fix listedGHSA-822f-jfpg-hg7h
—com.liferay.portal:release.portal.bom (Maven)7.4.0 to before 7.4.2-ga37.4.2-ga3Patch availableGHSA-822f-jfpg-hg7h
—com.liferay.portal:release.dxp.bom (Maven)7.2.0 to before 7.2.10.fp137.2.10.fp13Patch availableGHSA-822f-jfpg-hg7h
—com.liferay.portal:release.dxp.bom (Maven)7.3.0 to before 7.3.10.fp27.3.10.fp2Patch availableGHSA-822f-jfpg-hg7h
—com.liferay:com.liferay.site.browser.web (Maven)before 6.0.56.0.5Patch availableGHSA-822f-jfpg-hg7h
—com.liferay.portal:com.liferay.portal.impl (Maven)before 7.7.97.7.9Patch availableGHSA-822f-jfpg-hg7h
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.liferay.portal:release.portal.bom (Maven) Vendor— Affected — Fixed in — No fix listed GHSA-822f-jfpg-hg7h
  • com.liferay.portal:release.portal.bom (Maven) Vendor— Affected 7.4.0 to before 7.4.2-ga3 Fixed in 7.4.2-ga3 Patch available GHSA-822f-jfpg-hg7h
  • com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.2.0 to before 7.2.10.fp13 Fixed in 7.2.10.fp13 Patch available GHSA-822f-jfpg-hg7h
  • com.liferay.portal:release.dxp.bom (Maven) Vendor— Affected 7.3.0 to before 7.3.10.fp2 Fixed in 7.3.10.fp2 Patch available GHSA-822f-jfpg-hg7h
  • com.liferay:com.liferay.site.browser.web (Maven) Vendor— Affected before 6.0.5 Fixed in 6.0.5 Patch available GHSA-822f-jfpg-hg7h
  • com.liferay.portal:com.liferay.portal.impl (Maven) Vendor— Affected before 7.7.9 Fixed in 7.7.9 Patch available GHSA-822f-jfpg-hg7h

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_13:*:*:*:*:*:*7.2 fix_pack_13VulnerableLiferay
cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_2:*:*:*:*:*:*7.3 fix_pack_2VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.3.7:*:*:*:*:*:*:*7.3.7VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.4.0:*:*:*:*:*:*:*7.4.0VulnerableLiferay
cpe:2.3:a:liferay:liferay_portal:7.4.1:*:*:*:*:*:*:*7.4.1VulnerableLiferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_13:*:*:*:*:*:* Versions 7.2 fix_pack_13 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_2:*:*:*:*:*:* Versions 7.3 fix_pack_2 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.3.7:*:*:*:*:*:*:* Versions 7.3.7 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.4.0:*:*:*:*:*:*:* Versions 7.4.0 Vulnerable ·Liferay
  • cpe:2.3:a:liferay:liferay_portal:7.4.1:*:*:*:*:*:*:* Versions 7.4.1 Vulnerable ·Liferay

Remediation

  • Fix · GHSA-822f-jfpg-hg7h com.liferay.portal:release.portal.bom (Maven) Fixed in 7.4.2-ga3 Advisory →
  • Fix · GHSA-822f-jfpg-hg7h com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.2.10.fp13 Advisory →
  • Fix · GHSA-822f-jfpg-hg7h com.liferay.portal:release.dxp.bom (Maven) Fixed in 7.3.10.fp2 Advisory →
  • Fix · GHSA-822f-jfpg-hg7h com.liferay:com.liferay.site.browser.web (Maven) Fixed in 6.0.5 Advisory →
  • Fix · GHSA-822f-jfpg-hg7h com.liferay.portal:com.liferay.portal.impl (Maven) Fixed in 7.7.9 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-26595
  2. 2026-10-03 Alias added: GHSA-822f-jfpg-hg7h

References

Advisory 2

Other 4

  • TI-2023-22732 Cross-site scripting in Liferay DXP CVSS 3.1CRITICAL 9.6
  • TI-2022-20403 A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through… CVSS 3.1HIGH 8.8
  • TI-2025-03097 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
  • TI-2025-03169 Uncontrolled resource consumption in Liferay Portal CVSS 4.0HIGH 8.7
  • TI-2024-17354 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
  • TI-2024-16598 Cross-site scripting in Liferay Portal CVSS 3.1CRITICAL 9.6
See all 263 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences