CVE-2025-48881: Valtimo-Platform Valtimo-Backend-Libraries

High severity, CVSS 8.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If object-urls are exposed via other channels, the contents of these objects can be viewed independent of object-management configurations. This issue has been patched in version 12.13.0.RELEASE. A workaround for this issue involves overriding the endpoint security as defined in ObjectenApiHttpSecurityConfigurer and ObjectManagementHttpSecurityConfigurer. Depending on the implementation, this could result in loss of functionality.

Affected products

• Valtimo-Platform Valtimo-Backend-Libraries: from 11.0.0.RELEASE, up to and including 11.3.3.RELEASE; from 12.0.0.RELEASE, before 12.13.0.RELEASE (fixed in 12.13.0.RELEASE)

Published 2025-05-30. Last modified 2026-06-17.