CVE-2025-48881 Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users

Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If...

CVE-2025-48881

CVE-2025-48881 pertains to the valtimo-backend-libraries component. Vulnerable versions (11.0.0.RELEASE–11.3.3.RELEASE and 12.0.0.RELEASE–12.12.0.RELEASE) allow unauthorised users to list, view, edit, create or delete objects for which an object-management configuration exists; exposure of object...

CVE-2025-48881 Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users

Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If...

CVE-2025-48881 Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users

Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If...

valtimo-backend-libraries 安全漏洞

valtimo-backend-libraries is an open source business process automation platform from Valtimo. A security vulnerability exists in valtimo-backend-libraries that originates from an unauthorized user being able to list, view, edit, create, or delete objects...

GHSA-965R-9CG9-G42P Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users

Impact All objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If object-urls are exposed via other channels, the contents of these objects can be viewed independent of object-management configurations. Attack...

PT-2025-23221 · Valtimo · Valtimo

Name of the Vulnerable Software and Affected Versions: Valtimo versions 11.0.0.RELEASE through 11.3.3.RELEASE Valtimo versions 12.0.0.RELEASE through 12.12.0.RELEASE Description: The issue allows unauthorized users to list, view, edit, create, or delete objects for which an object-management...

CVE-2024-34706

Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token JWT of the user is exposed to api.form.io via the the x-jwt-token header. An attacker can retrieve personal information from this token, or use it to execute requests to the...

CVE-2024-34706

Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token JWT of the user is exposed to api.form.io via the the x-jwt-token header. An attacker can retrieve personal information from this token, or use it to execute requests to the...

@valtimo/components exposes access token to form.io

Impact When opening a form in Valtimo, the access token JWT of the user is exposed to api.form.io via the the x-jwt-token header. An attacker can retrieve personal information from this token, or use it to execute requests to the Valtimo REST API on behalf of the logged-in user. This issue is...

CVE-2024-34706

Valtimo exposes the user JWT in the x-jwt-token header to api.form.io due to a Form.io component misconfiguration. An attacker with network access to api.form.io and the Valtimo API, and who can read the token TTL (default 5 minutes), can access personal data or perform actions on behalf of the l...

CVE-2024-34706 @valtimo/components exposes access token to form.io

Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token JWT of the user is exposed to api.form.io via the the x-jwt-token header. An attacker can retrieve personal information from this token, or use it to execute requests to the...

CVE-2024-34706 @valtimo/components exposes access token to form.io

Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token JWT of the user is exposed to api.form.io via the the x-jwt-token header. An attacker can retrieve personal information from this token, or use it to execute requests to the...

CVE-2024-34706 @valtimo/components exposes access token to form.io

Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token JWT of the user is exposed to api.form.io via the the x-jwt-token header. An attacker can retrieve personal information from this token, or use it to execute requests to the...

PT-2024-26120 · Form.Io +2 · Form.Io +2

Name of the Vulnerable Software and Affected Versions: Valtimo versions prior to 10.8.4 Valtimo versions prior to 11.1.6 Valtimo versions prior to 11.2.2 Description: Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token JWT of t...