CVE-2025-48881

Valtimo is a platform for Business Process Automation. In versions starting from 11.0.0.RELEASE to 11.3.3.RELEASE and 12.0.0.RELEASE to 12.12.0.RELEASE, all objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If object-urls are exposed via other channels, the contents of these objects can be viewed independent of object-management configurations. This issue has been patched in version 12.13.0.RELEASE. A workaround for this issue involves overriding the endpoint security as defined in ObjectenApiHttpSecurityConfigurer and ObjectManagementHttpSecurityConfigurer. Depending on the implementation, this could result in loss of functionality.

• CWE-863

• https://github.com/valtimo-platform/valtimo-backend-libraries/commit/6ab04b30d3dab816bfea32d40ba50e5dd4517272
• https://github.com/valtimo-platform/valtimo-backend-libraries/security/advisories/GHSA-965r-9cg9-g42p

Published

May 30, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-48876Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2025-48877Discourse is an open-source discussion platform. Prior to ve…9.8
• CVE-2025-48878Combodo iTop is a web based IT service management tool. In v…4.3
• CVE-2025-48879OctoPrint versions up until and including 1.11.1 contain a v…6.5
• CVE-2025-4888A vulnerability, which was classified as critical, was found…7.8
• CVE-2025-48880FreeScout is a free self-hosted help desk and shared mailbox…6.6
• CVE-2025-48882PHPOffice Math is a library that provides a set of classes t…8.7
• CVE-2025-48883Chrome PHP allows users to start playing with chrome/chromiu…5.3
• CVE-2025-48884Galette is a membership management web application for non p…6.1
• CVE-2025-48885application-urlshortener create shortened URLs for XWiki pag…5.7
• CVE-2025-48886Hydra is a layer-two scalability solution for Cardano. Prior…4.8
• CVE-2025-48887vLLM, an inference and serving engine for large language mod…6.5