CVE-2026-54657 Details
Description
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter result querysets according to the authorizations associated with the request token. A caller with a valid zaken.lezen or documenten.lezen token can therefore retrieve case or document metadata outside the token's authorized types or confidentiality levels. Document searches require known UUIDs, and document content remains protected by separate download authorization. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.
A vulnerability exists in Open Zaak versions 1.0.0 prior to 1.27.2, 1.28.2, and 1.29.0, allowing unauthorized access to case or document metadata through the POST search endpoints '/zaken/api/v1/zaken/_zoek' and '/documenten/api/v1/enkelvoudiginformatieobjecten/_zoek'. The issue arises because these endpoints do not properly filter results based on the authorizations associated with the request token. As a result, a valid token holder can retrieve information beyond their authorized scope or confidentiality levels. While the vulnerability is more pronounced for the 'zaken' endpoint, the 'enkelvoudiginformatieobjecten' endpoint also poses a risk, albeit to a lesser extent, as it requires prior knowledge of specific UUIDs to access the document details.
Users can upgrade to Open Zaak versions 1.27.2, 1.28.2, or 1.29.0 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Open Zaak | >= 1.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |