CVE-2025-48881 Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users
Unauthorized users can list, view, edit, create, or delete objects in the Valtimo platform due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-48881?
CVE-2025-48881 is a high-severity missing authorization vulnerability in valtimo-platform valtimo-backend-libraries, published on 30 May 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If object-urls are exposed via other channels, the contents of these objects can be viewed independent of object-management configurations. This issue has been patched in version 12.13.0.RELEASE. A workaround for this issue involves overriding the endpoint security as defined in ObjectenApiHttpSecurityConfigurer and ObjectManagementHttpSecurityConfigurer. Depending on the implementation, this could result in loss of functionality.
Weakness: CWE-863
Which versions are affected by CVE-2025-48881?
8 open source packages ship an affected version, including com.ritense.valtimo:object-management and com.ritense.valtimo:objecten-api.
| Package | Affected | Fixed in |
|---|---|---|
com.ritense.valtimo:object-management Maven | From 11.0.0.RELEASE to 11.3.3.RELEASE | None |
com.ritense.valtimo:object-management Maven | From 11.0.0.RELEASE to 11.3.3.RELEASE | None |
com.ritense.valtimo:object-management Maven | From 12.0.0.RELEASE | 12.13.0.RELEASE |
com.ritense.valtimo:object-management Maven | From 12.0.0.RELEASE | 12.13.0.RELEASE |
com.ritense.valtimo:objecten-api Maven | From 11.0.0.RELEASE to 11.3.3.RELEASE | None |
com.ritense.valtimo:objecten-api Maven | From 11.0.0.RELEASE to 11.3.3.RELEASE | None |
2 more packages
com.ritense.valtimo:objecten-api Maven | From 12.0.0.RELEASE | 12.13.0.RELEASE |
com.ritense.valtimo:objecten-api Maven | From 12.0.0.RELEASE | 12.13.0.RELEASE |
How do I fix CVE-2025-48881?
Upgrade com.ritense.valtimo:object-management to 12.13.0.RELEASE or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-48881 being exploited?
There is no known exploitation of CVE-2025-48881 in the wild and no public exploit code.
Sources
Also known as GHSA-965r-9cg9-g42p.