Submit Feedback

Insecure Direct Object Reference vulnerability in Commerce Subscriptions

What changed: Subscription operations now validate that the targeted subscription entry belongs to the virtual instance of the requesting user. This covers viewing, editing, and deleting subscription entries.

Why: An authenticated user with elevated privileges could view, edit, or delete PayPal subscriptions belonging to another virtual instance by referencing the subscription entry ID directly. This is an Insecure Direct Object Reference.

Who is affected: Multi-instance Commerce deployments that use PayPal subscriptions.

How to update: Apply the patched release. Subscription operations across instances are now blocked.

Resource Type:
Official Documentation
Quarterly Releases:
2026.Q3 Release
Release Note Type:
Breaking Change
Release Note Product:
Liferay DXP