A Cross-Site Request Forgery (CSRF) vulnerability exists in the Headless API of Liferay Portal versions 7.4.0-ga1 through 7.4.3.107. This flaw allows remote attackers to execute any Headless API via the 'endpoint' parameter without proper authorization. The vulnerability affects multiple versions including Liferay Portal 7.4.0 through 7.4.3.107 and Liferay DXP 2023.Q3.1 through 2023.Q3.4, among others. A fix is available in version 7.4.3.108.