CVE-2025-48881
Description
Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If object-urls are exposed via other channels, the contents of these objects can be viewed independent of object-management configurations. This issue has been patched in version 12.13.0.RELEASE. A workaround for this issue involves overriding the endpoint security as defined in ObjectenApiHttpSecurityConfigurer and ObjectManagementHttpSecurityConfigurer. Depending on the implementation, this could result in loss of functionality.
How to fix
- com.ritense.valtimo:objecten-api12.13.0.RELEASE or later
- com.ritense.valtimo:object-management12.13.0.RELEASE or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| com.ritense.valtimo:objecten-apiMaven | 11.0.0.RELEASE ≤ v ≤ 11.3.3.RELEASE, 12.0.0.RELEASE ≤ v < 12.13.0.RELEASE | 12.13.0.RELEASE |
| com.ritense.valtimo:object-managementMaven | 11.0.0.RELEASE ≤ v ≤ 11.3.3.RELEASE, 12.0.0.RELEASE ≤ v < 12.13.0.RELEASE | 12.13.0.RELEASE |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.