CVE-2025-48881

Published May 30th, 2025

View on NVD ↗

CVSS v3

8.3

HIGH

CVSS v2

N/A

Affected

PROJECT

Description

Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If object-urls are exposed via other channels, the contents of these objects can be viewed independent of object-management configurations. This issue has been patched in version 12.13.0.RELEASE. A workaround for this issue involves overriding the endpoint security as defined in ObjectenApiHttpSecurityConfigurer and ObjectManagementHttpSecurityConfigurer. Depending on the implementation, this could result in loss of functionality.

valtimo-platform/valtimo-backend-libraries

Welcome at the Valtimo repository. Valtimo is the less-code platform for Business Process Automation. Built on top of business process orchestrator Camunda. Valtimo's goal is to make implementing business process automation and case management easy. Valtimo is the server side component for business process automation.

GitHub