What is the CVSS score of EUVD-2026-23296?

EUVD-2026-23296 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-23296?

Yes, a patch is available for EUVD-2026-23296. Update the affected software to the latest version immediately.

Valtimo EUVD-2026-23296

| CVE-2026-34164 MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2026-04-16 https://github.com/valtimo-platform/valtimo

GHSA-hfrg-mcvw-8mch

Information Disclosure

4.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.9 MEDIUM

Admin role required to access logs via network-accessible UI (PR:H, AV:N); full PII payload exposed (C:H); no integrity or availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:24 vuln.today

Analysis Generated

Jul 24, 2026 - 07:24 vuln.today

EUVD ID Assigned

Apr 16, 2026 - 21:15 euvd

EUVD-2026-23296

Patch released

Apr 16, 2026 - 21:15 nvd

Patch available

CVE Published

Apr 16, 2026 - 20:42 nvd

MEDIUM 4.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

40 maven packages depend on com.ritense.valtimo:inbox (2 direct, 38 indirect)

Ecosystem-wide dependent count for version 13.0.0.RELEASE.

DescriptionGitHub Advisory

Summary

The InboxHandlingService logs the full content of every incoming inbox message at INFO level (logger.info("Received message: {}", message)). Inbox messages are wrappers around outbox message data, which can contain highly sensitive information such as personal data (PII), citizen identifiers (BSN), and case details.

Impact

This data is exposed to:

Anyone with access to application logs (stdout/log files)
Any Valtimo user with the admin role, through the logging module in the Admin UI

Affected Code

com.ritense.inbox.InboxHandlingService#handle in the inbox module.

Resolution

Fixed in 13.22.0 via commit f16a1940ba (PR #497, tracking issue gzac-issues#653). The log statement was downgraded from INFO to DEBUG and the message payload was removed from the log output.

Mitigation

For versions before 13.22.0, consider:

Restricting access to application logs
Adjusting the log level for com.ritense.inbox to WARN or higher in your application configuration

AnalysisAI

Sensitive PII and citizen identifier (BSN) exposure in Valtimo's inbox module affects versions 13.0.0.RELEASE through 13.21.x, where InboxHandlingService logs full inbox message content at INFO level, making case details and personal data readable by anyone with application log access or the Valtimo admin role. The vulnerability requires high-privilege access (CVSS PR:H), confining realistic risk to insider threats or compromised admin accounts rather than external attackers. No public exploit exists and no active exploitation has been observed (EPSS 0.03%, SSVC exploitation: none); however, GDPR and privacy compliance implications are significant given BSN citizen identifiers may be exposed.

Technical ContextAI

Valtimo is a Dutch open-source low-code case management platform built on Spring Boot (Kotlin/Java), used primarily in Dutch government and public-sector workflows. The affected component is the inbox module (Maven artifact com.ritense.valtimo:inbox), which consumes outbox-pattern messages - event-driven wrappers that may carry full domain object payloads including PII, BSN citizen numbers, and case details. CWE-532 (Insertion of Sensitive Information into Log File) applies: the root cause is a single line in InboxHandlingService#handle - logger.info("Received message: {}", message) - which serializes the full message object at INFO level, meaning it appears in default log output without any filtering. The fix in commit f16a1940ba downgrades the statement to logger.debug{"Received inbox message"} and removes the payload entirely, so no sensitive data reaches any log level in production.

RemediationAI

Upgrade to Valtimo 13.22.0.RELEASE, which resolves the issue via PR #497 and commit f16a1940ba by changing the log statement from INFO with full payload to DEBUG with no payload. The release is available at https://github.com/valtimo-platform/valtimo/releases/tag/13.22.0 and the fix is confirmed in the vendor advisory GHSA-hfrg-mcvw-8mch. For deployments unable to upgrade immediately, set the log level for the com.ritense.inbox package to WARN or higher in your application configuration (e.g., logging.level.com.ritense.inbox=WARN in application.properties); this suppresses INFO output but may reduce operational visibility into inbox processing. Additionally, restrict access to application log aggregators and the Valtimo Admin UI logging module to only essential personnel. Note: log-level configuration is a workaround, not a fix - it does not remove the vulnerable log statement from the code.