CVE-2025-48881: Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users

Severity: high (CVSS 8.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-05-30 · updated 2026-06-17
Weakness: CWE-863

Description

Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If object-urls are exposed via other channels, the contents of these objects can be viewed independent of object-management configurations. This issue has been patched in version 12.13.0.RELEASE. A workaround for this issue involves overriding the endpoint security as defined in ObjectenApiHttpSecurityConfigurer and ObjectManagementHttpSecurityConfigurer. Depending on the implementation, this could result in loss of functionality.

Affected products

valtimo-platform valtimo-backend-libraries: from 11.0.0.RELEASE, <= 11.3.3.RELEASE; from 12.0.0.RELEASE, < 12.13.0.RELEASE

References

Get alerted when CVE-2025-48881 or the next vulnerability affects your stack