{"id":"BIT-liferay-2022-26595","details":"Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of sites/groups, which allows remote authenticated users to view sites/groups via the user's site membership assignment UI.","aliases":["CVE-2022-26595","GHSA-822f-jfpg-hg7h"],"modified":"2025-07-14T20:44:39.396072Z","published":"2024-01-31T15:21:09.770Z","database_specific":{"cpes":["cpe:2.3:a:liferay:digital_experience_platform:7.2:fix_pack_13:*:*:*:*:*:*","cpe:2.3:a:liferay:digital_experience_platform:7.3:fix_pack_2:*:*:*:*:*:*"],"severity":"Medium"},"references":[{"type":"WEB","url":"http://liferay.com"},{"type":"WEB","url":"https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/cve-2022-26595-unauthorized-access-to-site-group-list"}],"affected":[{"package":{"name":"liferay","ecosystem":"Bitnami","purl":"pkg:bitnami/liferay"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.2-fix.0"},{"last_affected":"7.2-fix.0"},{"introduced":"7.3-fix.0"},{"last_affected":"7.3-fix.0"}]}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/liferay/BIT-liferay-2022-26595.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}]}],"schema_version":"1.7.3"}