---
id: "CVE-2026-54657"
kind: "vulnerability"
aliases: ["CVE-2026-54657"]
title: "Open Zaak: search endpoints return case metadata beyond token permissions"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["case-management", "dutch-government", "open-zaak", "package", "self-hosted"]
not_affected_if: ["full-access-tokens-only", "patched-version"]
published_at: "2026-10-16T16:18:43+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:57:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54657", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# Open Zaak: search endpoints return case metadata beyond token permissions

Open Zaak's POST search endpoints for cases and documents do not filter results by the authorizations on the request token. A caller with a valid zaken.lezen or documenten.lezen token can read case or document metadata outside their authorized case types or confidentiality levels.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Open Zaak version; the sources say versions 1.0.0 through 1.27.1, 1.28.0 through 1.28.1, and 1.29.0 pre-fix are affected.
- Check whether tokens with zaken.lezen or documenten.lezen are issued to callers that should only see a subset of case types or confidentiality levels.

## Fix

- Upgrade Open Zaak to `1.27.2`, `1.28.2`, or `1.29.0` depending on the release line in use.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-54657

## From the sources

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter result querysets according to the authorizations associated with the request token. A caller with a valid zaken.lezen or documenten.lezen token can therefore retrieve case or document metadata outside the token's authorized types or confidentiality levels. Document searches require known UUIDs, and document content remains protected by separate download authorization. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_