CVE-2026-54657
mediumOpen Zaak is an open-source data and services layer for Dutch case-oriented working.
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter result querysets according to the authorizations associated with the request token. A caller with a valid zaken.lezen or documenten.lezen token can therefore retrieve case or document metadata outside the token's authorized types or confidentiality levels. Document searches require known UUIDs, and document content remains protected by separate download authorization. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/open-zaak/open-zaak/commit/15456f1a0ef4b0abf1b1c0e3a16c99c15423b9fd security-advisories@github.com
- https://github.com/open-zaak/open-zaak/commit/4b429d3243d1532f6fe731f932a201cf0ddc4c18 security-advisories@github.com
- https://github.com/open-zaak/open-zaak/commit/d3869af98c60570782f867bab3e1d14fd8d8330f security-advisories@github.com
- https://github.com/open-zaak/open-zaak/releases/tag/1.27.2 security-advisories@github.com
- https://github.com/open-zaak/open-zaak/releases/tag/1.28.2 security-advisories@github.com
- https://github.com/open-zaak/open-zaak/releases/tag/1.29.0 security-advisories@github.com
- https://github.com/open-zaak/open-zaak/security/advisories/GHSA-f29q-7rpr-jmjx security-advisories@github.com