CVE-2025-48881

Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users

State: Published
Severity: 8.3 High
Published: May 30, 2025
Updated: Jun 4, 2025
Reserved: May 27, 2025

Description

Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If object-urls are exposed via other channels, the contents of these objects can be viewed independent of object-management configurations. This issue has been patched in version 12.13.0.RELEASE. A workaround for this issue involves overriding the endpoint security as defined in ObjectenApiHttpSecurityConfigurer and ObjectManagementHttpSecurityConfigurer. Depending on the implementation, this could result in loss of functionality.

Scores

CVSS	Score	Vector	Source
3.1	8.3 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L	GitHub_M

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
valtimo-backend-librariesvaltimo-platform	>= 11.0.0.RELEASE, <= 11.3.3.RELEASEAffected >= 12.0.0.RELEASE, < 12.13.0.RELEASEAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.