cve.bz

CVE-2025-48881

8.3 highEPSS 0.3%

High (8.3). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in com.ritense.valtimo:object-management 12.13.0.RELEASE.

Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If object-urls are exposed via other channels, the contents of these objects can be viewed independent of object-management configurations. This issue has been patched in version 12.13.0.RELEASE. A workaround for this issue involves overriding the endpoint security as defined in ObjectenApiHttpSecurityConfigurer and ObjectManagementHttpSecurityConfigurer. Depending on the implementation, this could result in loss of functionality.

Severity

CVSS 3.1

8.3 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
EPSS
0.3% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-10-31)
CWE
CWE-863
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-965r-9cg9-g42pMavencom.ritense.valtimo:objecten-api>=11.0.0.RELEASE <=11.3.3.RELEASEno fix published
GHSA-965r-9cg9-g42pMavencom.ritense.valtimo:object-management>=11.0.0.RELEASE <=11.3.3.RELEASEno fix published
GHSA-965r-9cg9-g42pMavencom.ritense.valtimo:object-management>=12.0.0.RELEASE <12.13.0.RELEASE12.13.0.RELEASE
GHSA-965r-9cg9-g42pMavencom.ritense.valtimo:objecten-api>=12.0.0.RELEASE <12.13.0.RELEASE12.13.0.RELEASE

References

Check your stackJSON