Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

com.ritense.valtimo:inbox

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.9MavenPublished

    Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService

    CVE-2026-34164 · GHSA-hfrg-mcvw-8mch

    Affected
    • Maven com.ritense.valtimo:inbox >= 13.0.0.RELEASE, < 13.22.0.RELEASE
    Fixed in
    13.22.0.RELEASE· Vendor fix available
    Issue
    The InboxHandlingService logs the full content of every incoming inbox message at INFO level (logger.info("Received message: {}", message)). Inbox messages are wrappers around outbox message data, which can contain highly sensitive information such as personal data (PII), citizen identifiers (BSN), and case details. Impact This data is exposed to: - Anyone with access to application logs (stdout/log files) - Any Valtimo user with the admin role, through the logging module in the Admin UI Affected Code com.ritense.inbox.InboxHandlingService#handle in the inbox module. Resolution Fixed in 13.22.0 via commit f16a1940ba (PR #497, tracking issue gzac-issues#653). The log statement was downgraded from INFO to DEBUG and the message payload was removed from the log output. Mitigation For versions before 13.22.0, consider: - Restricting access to application logs - Adjusting the log level for com.ritense.inbox to WARN or higher in your application configuration

    Recommended action: Upgrade to 13.22.0.RELEASE or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →