CVE-2022-26595
Liferay Portal and Liferay DXP fails to check permissions to view sites/groups
Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI.
- Record
CVE-2022-26595- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-276
- Updated
- 2026-11-02
CVE List No score
Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI.
- Record
CVE-2022-26595- Updated
- 2026-11-02
EUVDEUVD-2022-31150 No score
Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI.
- Record
EUVD-2022-31150- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-822f-jfpg-hg7h
Liferay Portal and Liferay DXP fails to check permissions to view sites/groups
Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI.
- Record
GHSA-822f-jfpg-hg7h- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-276
- Updated
- 2026-11-02
OSVGHSA-822f-jfpg-hg7h
Liferay Portal and Liferay DXP fails to check permissions to view sites/groups
Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI.
- Record
GHSA-822f-jfpg-hg7h- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-276
- Updated
- 2026-11-02
OSVBIT-liferay-2022-26595 No score
Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI.
- Record
BIT-liferay-2022-26595- Updated
- 2026-11-02
OSV No score
Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI.
- Record
CVE-2022-26595- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.liferay.portal:release.portal.bomMaven |
7.3.7 to 7.3.7 | None known |
com.liferay.portal:release.portal.bomMaven |
7.4.0 up to 7.4.2-ga3 | 7.4.2-ga3 |
com.liferay.portal:release.dxp.bomMaven |
7.2.0 up to 7.2.10.fp13 | 7.2.10.fp13 |
com.liferay.portal:release.dxp.bomMaven |
7.3.0 up to 7.3.10.fp2 | 7.3.10.fp2 |
com.liferay:com.liferay.site.browser.webMaven |
before 6.0.5 | 6.0.5 |
com.liferay.portal:com.liferay.portal.implMaven |
before 7.7.9 | 7.7.9 |
liferayBitnami |
7.2-fix.0 to 7.2-fix.0, 7.3-fix.0 to 7.3-fix.0 | None known |
com.liferay.portal:release.portal.bomMaven |
Listed versions 7.3.7 |
None known |
com.liferay.portal:release.portal.bomMaven |
7.4.0 up to 7.4.2-ga3, plus listed versions 7.4.17.4.1-17.4.27.4.2-1 |
7.4.2-ga3 |
com.liferay.portal:release.dxp.bomMaven |
7.2.0 up to 7.2.10.fp13, plus listed versions 7.2.17.2.107.2.10.fp17.2.10.fp1-17.2.10.fp10 Show 10 moreShow less7.2.10.fp117.2.10.fp127.2.10.fp27.2.10.fp37.2.10.fp47.2.10.fp57.2.10.fp67.2.10.fp77.2.10.fp87.2.10.fp9 |
7.2.10.fp13 |
com.liferay.portal:release.dxp.bomMaven |
7.3.0 up to 7.3.10.fp2, plus listed versions 7.3.107.3.10.ep37.3.10.ep47.3.10.ep57.3.10.fp1 |
7.3.10.fp2 |
com.liferay:com.liferay.site.browser.webMaven |
before 6.0.5, plus listed versions 1.0.02.0.02.0.12.0.102.0.11 Show 45 moreShow less2.0.122.0.132.0.142.0.152.0.162.0.172.0.182.0.192.0.22.0.202.0.212.0.222.0.232.0.242.0.252.0.262.0.272.0.282.0.292.0.32.0.302.0.312.0.322.0.332.0.342.0.352.0.362.0.372.0.382.0.392.0.42.0.402.0.412.0.422.0.432.0.442.0.452.0.462.0.472.0.52.0.62.0.72.0.82.0.93.0.0 |
6.0.5 |
com.liferay.portal:com.liferay.portal.implMaven |
before 7.7.9, plus listed versions 1.0.01.0.12.0.02.1.02.10.0 Show 45 moreShow less2.11.02.12.02.13.02.14.02.15.02.16.02.17.02.18.02.19.02.2.02.20.02.21.02.22.02.23.02.24.02.25.02.25.12.25.22.25.32.26.02.26.12.26.22.27.02.27.12.27.22.28.02.28.12.28.22.29.02.3.02.30.02.30.12.30.22.30.32.30.42.31.02.32.02.32.12.33.02.33.12.33.22.34.02.34.12.35.02.36.0 |
7.7.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-26595 is a medium vulnerability (CVSS 4.3) in Liferay Portal, published April 19, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 55th percentile. Fixed in com.liferay.portal:release.portal.bom 7.4.2-ga3.
References
portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-26595-unauthorized-access-to-site-group-list
nvd.nist.gov/vuln/detail/CVE-2022-26595
github.com/liferay/liferay-portal/commit/5b958de42d93f1ba5879a0a20054b14ad7f145c4
liferay.atlassian.net/issues/LPE-17367
liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-26595-unauthorized-access-to-site-group-list?p_r_p_assetEntryId=121612195&_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612195%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse
liferay.com
Left out here: 1,368 versions. The JSON record has them.