CVE-2026-54657
Received Received - Intake

Authorization Bypass in Open Zaak Search Endpoints

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter result querysets according to the authorizations associated with the request token. A caller with a valid zaken.lezen or documenten.lezen token can therefore retrieve case or document metadata outside the token's authorized types or confidentiality levels. Document searches require known UUIDs, and document content remains protected by separate download authorization. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-54657
EUVD
EUVD-2026-102899

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
open-zaak open-zaak >= 1.0.0, < 1.27.2
open-zaak open-zaak >= 1.28.0, < 1.28.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Open Zaak is a system for Dutch case management. This vulnerability allows users with limited access tokens to retrieve case or document metadata beyond their authorized scope. The affected search endpoints do not properly filter results based on token permissions, enabling unauthorized data exposure.

Detection Guidance

Check Open Zaak versions between 1.0.0 and 1.27.2, 1.28.2, or 1.29.0. Verify if POST requests to /zaken/api/v1/zaken/_zoek or /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek return unauthorized data. Monitor logs for unusual access patterns to these endpoints.

Impact Analysis

If you use Open Zaak, attackers or unauthorized users could access sensitive case or document metadata they shouldn't see. This could lead to data leaks, privacy violations, or compliance breaches. Document content remains protected but metadata like titles and authors may be exposed.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data metadata without proper authorization. For HIPAA, it may compromise protected health information confidentiality. Organizations must ensure proper access controls to maintain compliance with these regulations.

Mitigation Strategies

Upgrade Open Zaak to versions 1.27.2, 1.28.2, or 1.29.0 immediately. Restrict network access to the vulnerable endpoints. Review and audit recent access logs for unauthorized queries. Apply principle of least privilege to API tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54657. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart