关键漏洞信息 漏洞标题 Objects in the object-api can be accessed and modified by unauthorised users 严重性 Severity: High (8.3/10) 影响的包和版本 com.ritense.valtimo:object-management (Maven) - Affected versions: >= 11.0.0.RELEASE, = 12.0.0.RELEASE, = 11.0.0.RELEASE, = 12.0.0.RELEASE, <= 12.12.0.RELEASE - Patched versions: None 描述 Impact: - All objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. - If object-urls are exposed via other channels, the contents of these objects can be viewed independent of object-management configurations. Attack requirements: - A user must be logged in (No relevant application roles are required) - At least one object-type must be configured via object-management - The scope of the attack is limited to objects that are configured via object-management. - The value of is irrelevant for this attack 补丁和变通方法 Patches: No patch is available yet Workarounds: - It is possible to override the endpoint security as defined in and . Depending on the implementation, this could result in loss of functionality. 其他信息 CVE ID: CVE-2025-48881 Weaknesses: No CWEs