Vulnerability · Published Oct 16, 2026 · Assigned by GitHub_M
CVE-2026-54657Open Zaak: /zaken/_zoek and /enkelvoudiginformatieobjecten/_zoek endpoints do not filter result lists based on authorizations linked to token
Medium 6.5
In plain English
A medium-severity authorization bypass via user-controlled key in open-zaak from open-zaak. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Official description
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter result querysets according to the authorizations associated with the request token. A caller with a valid zaken.lezen or documenten.lezen token can therefore retrieve case or document metadata outside the token's authorized types or confidentiality levels. Document searches require known UUIDs, and document content remains protected by separate download authorization. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.
Affected products (as reported)
Weakness: CWE-285, CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/open-zaak/open-zaak/security/advisories/GHSA-f29q-7rpr-jmjx x_refsource_CONFIRM
- https://github.com/open-zaak/open-zaak/commit/15456f1a0ef4b0abf1b1c0e3a16c99c15423b9fd x_refsource_MISC
- https://github.com/open-zaak/open-zaak/commit/4b429d3243d1532f6fe731f932a201cf0ddc4c18 x_refsource_MISC
- https://github.com/open-zaak/open-zaak/commit/d3869af98c60570782f867bab3e1d14fd8d8330f x_refsource_MISC
- https://github.com/open-zaak/open-zaak/releases/tag/1.27.2 x_refsource_MISC
- https://github.com/open-zaak/open-zaak/releases/tag/1.28.2 x_refsource_MISC
- https://github.com/open-zaak/open-zaak/releases/tag/1.29.0 x_refsource_MISC