Valtimo is an open‑source business process automation platform that, in versions 13.0.0 through 13.21.0, logs the full content of every incoming inbox message at INFO level. Inbox messages can contain highly sensitive information such as personal data, citizen identifiers, and case details. Because the service logs the complete message body, anyone who can read the application logs or a Valtimo user with an admin role who has access to the Admin UI logging module can view that data. The vulnerability originates from insecure logging of sensitive information (CWE‑532), allowing disclosure of confidential data.

This issue affects the Valtimo platform, specifically versions 13.0.0 through 13.21.0. An update to 13.22.0 fixes the problem, so systems running older releases are vulnerable.

The CVSS score is 4.9, indicating a moderate severity combined with low impact and limited privilege escalation. EPSS data is not available, but the vulnerability does not require a special environment to exploit; any user or attacker who gains access to application logs or has administrator privileges can read the logged content. Because the vulnerability is an information‑leak rather than a direct attack vector, it is not listed in the CISA KEV catalog. Nonetheless, an attacker who can read logs could obtain PII or case details, potentially enabling identity‑theft or targeted phishing. Mitigation requires limiting log exposure and updating the vulnerable version.