Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService
Summary
The InboxHandlingService logs the full content of every incoming inbox message at INFO level (logger.info("Received message: {}", message)). Inbox messages are wrappers around outbox message data, which can contain highly sensitive information such as personal data (PII), citizen identifiers (BSN), and case details.
Impact
This data is exposed to:
- Anyone with access to application logs (stdout/log files)
- Any Valtimo user with the admin role, through the logging module in the Admin UI
Affected Code
com.ritense.inbox.InboxHandlingService#handle in the inbox module.
Resolution
Fixed in 13.22.0 via commit f16a1940ba (PR #497, tracking issue gzac-issues#653). The log statement was downgraded from INFO to DEBUG and the message payload was removed from the log output.
Mitigation
For versions before 13.22.0, consider:
- Restricting access to application logs
- Adjusting the log level for
com.ritense.inboxto WARN or higher in your application configuration
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | com.ritense.valtimo:inbox | >= 13.0.0.RELEASE, < 13.22.0.RELEASE | 13.22.0.RELEASE |
References
- https://github.com/valtimo-platform/valtimo/security/advisories/GHSA-hfrg-mcvw-8mch
- https://nvd.nist.gov/vuln/detail/CVE-2026-34164
- https://github.com/generiekzaakafhandelcomponent/gzac-issues/issues/653
- https://github.com/valtimo-platform/valtimo/pull/497
- https://github.com/valtimo-platform/valtimo/commit/f16a1940ba7b34627c0b966f98ca78655ace9335
- https://github.com/valtimo-platform/valtimo
- https://github.com/valtimo-platform/valtimo/releases/tag/13.22.0
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-532- Platform
- Java / Kotlin (Maven)
- Package
com.ritense.valtimo:inbox- Disclosed
- 16.04.2026
- Updated
- 11.10.2026 13:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-hfrg-mcvw-8mch - CC BY 4.0
Vulnerability history: com.ritense.valtimo:inbox
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.