Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the JoinWorkflowSpec process. An attacker can gain unauthorized access to host networking, override service account assignments, modify pod security contexts, add tolerations, or enable service account token...

PT-2025-23221 · Valtimo · Valtimo

Name of the Vulnerable Software and Affected Versions: Valtimo versions 11.0.0.RELEASE through 11.3.3.RELEASE Valtimo versions 12.0.0.RELEASE through 12.12.0.RELEASE Description: The issue allows unauthorized users to list, view, edit, create, or delete objects for which an object-management...

GraphQL grant on a property might be cached with different objects

Original message: I found an issue with security grants on on properties in the GraphQL ItemNormalizer: If you use something like ApiPropertysecurity: 'isgranted"PROPERTYREAD", object, property' on a member of an entity, the grant gets cached and is only evaluated once, even if the object in...