Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService
Summary
The InboxHandlingService logs the full content of every incoming inbox message at INFO level (logger.info("Received message: {}", message)). Inbox messages are wrappers around outbox message data, which can contain highly sensitive information such as personal data (PII), citizen identifiers (BSN), and case details.
Impact
This data is exposed to:
- Anyone with access to application logs (stdout/log files)
- Any Valtimo user with the admin role, through the logging module in the Admin UI
Affected Code
com.ritense.inbox.InboxHandlingService#handle in the inbox module.
Resolution
Fixed in 13.22.0 via commit f16a1940ba (PR #497, tracking issue gzac-issues#653). The log statement was downgraded from INFO to DEBUG and the message payload was removed from the log output.
Mitigation
For versions before 13.22.0, consider:
- Restricting access to application logs
- Adjusting the log level for
com.ritense.inboxto WARN or higher in your application configuration
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Java / Kotlin (Maven) | com.ritense.valtimo:inbox | >= 13.0.0.RELEASE, < 13.22.0.RELEASE | 13.22.0.RELEASE |
Referencias
- https://github.com/valtimo-platform/valtimo/security/advisories/GHSA-hfrg-mcvw-8mch
- https://nvd.nist.gov/vuln/detail/CVE-2026-34164
- https://github.com/generiekzaakafhandelcomponent/gzac-issues/issues/653
- https://github.com/valtimo-platform/valtimo/pull/497
- https://github.com/valtimo-platform/valtimo/commit/f16a1940ba7b34627c0b966f98ca78655ace9335
- https://github.com/valtimo-platform/valtimo
- https://github.com/valtimo-platform/valtimo/releases/tag/13.22.0
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N- Debilidad (CWE)
CWE-532- Plataforma
- Java / Kotlin (Maven)
- Paquete
com.ritense.valtimo:inbox- Publicada
- 16.04.2026
- Actualizado
- 11.10.2026 13:20
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-hfrg-mcvw-8mch - CC BY 4.0
Historial de vulnerabilidades: com.ritense.valtimo:inbox
Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
Esta es la única vulnerabilidad conocida de este paquete.
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.