Live › vulnerability › CVE-2026-54657
Go to dashboardOpen Zaak's POST search endpoints for cases and documents do not filter results by the authorizations on the request token. A caller with a valid zaken.lezen or documenten.lezen token can read case or document metadata outside their authorized case types or confidentiality levels.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Open Zaak from 1.0.0 up to the fixed releases that issue tokens scoped by case type or confidentiality level. Exposure depends on callers holding a valid read token; document searches also require known UUIDs, and document content stays behind separate download authorization. Deployments that give every token full read access, or that run a patched version, are not meaningfully exposed.
No product ranges from the sources yet.
1.27.2, 1.28.2, or 1.29.0 depending on the release line in use.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter result querysets according to the authorizations associated with the request token. A caller with a valid zaken.lezen or documenten.lezen token can therefore retrieve case or document metadata outside the token's authorized types or confidentiality levels. Document searches require known UUIDs, and document content remains protected by separate download authorization. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-54657")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.