Authorization Flaw in Workflow Component of Dutch Municipality Software
CVE-2026-55551

6.5MEDIUM

Key Information:

Vendor

Infonl

Status
Dimpact-zaakafhandelcomponent
Vendor
CVE Published:
30 October 2026

What is CVE-2026-55551?

The ZAC open-source workflow component, utilized for municipal case management in the Netherlands, exhibits a significant authorization flaw prior to version 5.2.0. Specific endpoints in the system fail to enforce necessary policy checks, allowing low-privileged authenticated users to access sensitive information about cases and decisions without proper authorization. Attackers can exploit this flaw through specific GET requests to reveal critical details, audit histories, and workflows across unauthorized case types. The vulnerability is addressed in version 5.2.0, emphasizing the importance of keeping systems updated to prevent unauthorized data exposure.

Affected Version(s)

dimpact-zaakafhandelcomponent < 5.2.0

References

https://github.com/infonl/dimpact-zaakafhandelcomponent/s...
x_refsource_CONFIRM
https://github.com/infonl/dimpact-zaakafhandelcomponent/p...
x_refsource_MISC
https://github.com/infonl/dimpact-zaakafhandelcomponent/p...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.