> For the complete documentation index, see [llms.txt](https://docs.valtimo.nl/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.valtimo.nl/v12/release-notes/12.x.x/12.44.0.md).

# 12.44.0

## Bugfixes

* **Object permissions are checked before the object is retrieved**

  A user without permission to view objects is now refused before anything is requested from the Objecten API.

## Security

* **Permission checks only accept known resource types**

  When Valtimo was asked whether a user may perform an action, the resource type in that question was taken at face value, which allowed any signed-in user to make the server load arbitrary internal parts of the application. Only the resource types that can be selected under **Access control** are accepted now, and anything else is answered as "not permitted", so normal use is unaffected.