Read the docs
TI-2025-31031 Aliases CVE-2025-48881GHSA-965r-9cg9-g42p

Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users

Priority LOW 38CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If object-urls are exposed via other channels, the contents of these objects can be viewed independent of object-management configurations. This issue has been patched in version 12.13.0.RELEASE. A workaround for this issue involves overriding the endpoint security as defined in ObjectenApiHttpSecurityConfigurer and ObjectManagementHttpSecurityConfigurer. Depending on the implementation, this could result in loss of functionality.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00346 28th percentileScored 2026-11-07
Fix Fixed valtimo-backend-libraries (valtimo-platform): 12.13.0.RELEASEcom.ritense.valtimo:object-management (Maven): 12.13.0.RELEASE+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
valtimo-platformvaltimo-backend-libraries11.0.0.RELEASE – 11.3.3.RELEASE; 12.0.0.RELEASE to before 12.13.0.RELEASE12.13.0.RELEASEPatch availableCNA
—com.ritense.valtimo:objecten-api (Maven)11.0.0.RELEASE – 11.3.3.RELEASE—No fix listedGHSA-965r-9cg9-g42p
—com.ritense.valtimo:object-management (Maven)11.0.0.RELEASE – 11.3.3.RELEASE—No fix listedGHSA-965r-9cg9-g42p
—com.ritense.valtimo:object-management (Maven)12.0.0.RELEASE to before 12.13.0.RELEASE12.13.0.RELEASEPatch availableGHSA-965r-9cg9-g42p
—com.ritense.valtimo:objecten-api (Maven)12.0.0.RELEASE to before 12.13.0.RELEASE12.13.0.RELEASEPatch availableGHSA-965r-9cg9-g42p
  • valtimo-backend-libraries Vendorvaltimo-platform Affected 11.0.0.RELEASE – 11.3.3.RELEASE; 12.0.0.RELEASE to before 12.13.0.RELEASE Fixed in 12.13.0.RELEASE Patch available CNA
  • com.ritense.valtimo:objecten-api (Maven) Vendor— Affected 11.0.0.RELEASE – 11.3.3.RELEASE Fixed in — No fix listed GHSA-965r-9cg9-g42p
  • com.ritense.valtimo:object-management (Maven) Vendor— Affected 11.0.0.RELEASE – 11.3.3.RELEASE Fixed in — No fix listed GHSA-965r-9cg9-g42p
  • com.ritense.valtimo:object-management (Maven) Vendor— Affected 12.0.0.RELEASE to before 12.13.0.RELEASE Fixed in 12.13.0.RELEASE Patch available GHSA-965r-9cg9-g42p
  • com.ritense.valtimo:objecten-api (Maven) Vendor— Affected 12.0.0.RELEASE to before 12.13.0.RELEASE Fixed in 12.13.0.RELEASE Patch available GHSA-965r-9cg9-g42p

Remediation

  • Fix · CNA valtimo-backend-libraries (valtimo-platform) Fixed in 12.13.0.RELEASE
  • Fix · GHSA-965r-9cg9-g42p com.ritense.valtimo:object-management (Maven) Fixed in 12.13.0.RELEASE Advisory →
  • Fix · GHSA-965r-9cg9-g42p com.ritense.valtimo:objecten-api (Maven) Fixed in 12.13.0.RELEASE Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-48881
  2. 2026-10-03 Alias added: GHSA-965r-9cg9-g42p

References

Advisory 1

Other 3

  • TI-2024-23003 @valtimo/components exposes access token to form.io CVSS 3.1CRITICAL 9.8
  • TI-2026-30835 Valtimo: SpEL injection via StandardEvaluationContext allows Remote Code Execution by admin users CVSS 3.1CRITICAL 9.1
  • TI-2025-35902 Valtimo scripting engine can be used to gain access to sensitive data or resources CVSS 3.1CRITICAL 9.1
  • TI-2026-32446 Valtimo: Sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer CVSS 3.1HIGH 7.6
  • TI-2026-26464 Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService CVSS 3.1MEDIUM 4.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences