Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2025-48881GHSA-965R-9CG9-G42P

Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 12.13.0.RELEASE
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If object-urls are exposed via other channels, the contents of these objects can be viewed independent of object-management configurations. This issue has been patched in version 12.13.0.RELEASE. A workaround for this issue involves overriding the endpoint security as defined in ObjectenApiHttpSecurityConfigurer and ObjectManagementHttpSecurityConfigurer. Depending on the implementation, this could result in loss of functionality.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • valtimo-platform valtimo-backend-libraries

    From 11.0.0.RELEASE · through 11.3.3.RELEASE; From 12.0.0.RELEASE · fixed in 12.13.0.RELEASE

  • com.ritense.valtimo:objecten-apiMaven

    From 11.0.0.RELEASE · through 11.3.3.RELEASE

  • com.ritense.valtimo:object-managementMaven

    From 11.0.0.RELEASE · through 11.3.3.RELEASE

  • com.ritense.valtimo:object-managementMaven

    From 12.0.0.RELEASE · fixed in 12.13.0.RELEASE

  • com.ritense.valtimo:objecten-apiMaven

    From 12.0.0.RELEASE · fixed in 12.13.0.RELEASE

References 2

GitHub · valtimo-platform/valtimo-backend-libraries