CVE-2026-34164

Katalog CVE

CVSS 4.9 · Medium EPSS 0,49%

Kerentanan Insertion of Sensitive Information into Log File. Skor CVSS 3.1 4.9 (Medium) menurut github.com.

Deskripsi (NVD)

Valtimo is an open-source business process automation platform. In versions 13.0.0 through 13.21.0, the InboxHandlingService logs the full content of every incoming inbox message at INFO level. Inbox messages can contain highly sensitive information including personal data (PII), citizen identifiers (BSN), and case details. This data is exposed to anyone with access to application logs or any Valtimo user with the admin role through the Admin UI logging module. This issue has been fixed in version 13.22.0. If developers are unable to upgrade immediately, they can restrict access to application logs and adjust the log level for com.ritense.inbox to WARN or higher in their application configuration as a workaround.

Rincian

Terbit di NVD

16 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

4.9 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-532: Insertion of Sensitive Information into Log File

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/generiekzaakafhandelcomponent/gzac-issues/issues/653
• https://github.com/valtimo-platform/valtimo/commit/f16a1940ba7b34627c0b966f98ca78655ace9335
• https://github.com/valtimo-platform/valtimo/pull/497
• https://github.com/valtimo-platform/valtimo/releases/tag/13.22.0
• https://github.com/valtimo-platform/valtimo/security/advisories/GHSA-hfrg-mcvw-8mch