Authorization Bypass in Open Zaak by Dutch Case Management Vendor
CVE-2026-54657
What is CVE-2026-54657?
Open Zaak, an open-source data and services layer for case-oriented working in the Netherlands, is susceptible to an authorization bypass whereby users with specific access tokens can retrieve case or document metadata beyond their authorized scope. The affected POST search endpoints, namely /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek, fail to apply proper filters for the result querysets correlating with the request token authorizations. This vulnerability allows unauthorized access to sensitive information if valid zaken.lezen or documenten.lezen tokens are used. Document content access remains secured by separate download authorizations, yet, the metadata exposure poses a significant risk. Users should upgrade to secure versions 1.27.2, 1.28.2, or 1.29.0 to mitigate this issue.
Affected Version(s)
open-zaak >= 1.0.0, < 1.27.2 < 1.0.0, 1.27.2
open-zaak >= 1.28.0, < 1.28.2 < 1.28.0, 1.28.2