PT-2026-33366 · Valtimo · Valtimo

Published 2026-04-16 · Updated 2026-04-17 · CVE-2026-34164

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Valtimo versions 13.0.0 through 13.21.0

Description The InboxHandlingService function handle() in the inbox module logs the full content of every incoming inbox message at the INFO level. These messages may contain sensitive information, such as personally identifiable information (PII), citizen identifiers (BSN), and case details. This data is exposed to individuals with access to application logs or Valtimo users with the admin role via the Admin UI logging module.

Recommendations Update to version 13.22.0. Restrict access to application logs. Adjust the log level for com.ritense.inbox to WARN or higher in the application configuration.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2026-34164

GHSA-HFRG-MCVW-8MCH

Affected Products

Valtimo

References · 9

• https://osv.dev/vulnerability/GHSA-hfrg-mcvw-8mch · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34164 · Security Note
• https://github.com/valtimo-platform/valtimo · Note
• https://github.com/valtimo-platform/valtimo/commit/f16a1940ba7b34627c0b966f98ca78655ace9335 · Note
• https://github.com/valtimo-platform/valtimo/releases/tag/13.22.0 · Note
• https://github.com/valtimo-platform/valtimo/security/advisories/GHSA-hfrg-mcvw-8mch · Note
• https://github.com/valtimo-platform/valtimo/pull/497 · Note
• https://github.com/generiekzaakafhandelcomponent/gzac-issues/issues/653 · Note
• https://twitter.com/CVEnew/status/2045102648127377457 · Twitter Post