Live › vulnerability › CVE-2026-55551
ZAC is a workflow case management component used by Dutch municipalities. Several by-ID REST endpoints for cases and decisions omit the policy check, so an authenticated low-privileged user who knows a case UUID can read decisions, audit history, workflow diagrams and mailbox configuration for case types they should not access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 17:31 UTC. All times on this page are UTC.
Municipalities and organisations running ZAC with several case types and users holding only an application role. The sources say the search endpoints are correctly filtered and not part of this flaw. Installations on 5.2.0 or later are not affected.
No product ranges from the sources yet.
5.2.0 are affected./rest/zaken/besluit/zaakUuid/{uuid}, /rest/zaken/besluit/{uuid}/historie, /rest/zaken/{uuid}/process-diagram and /rest/zaken/{uuid}/afzender.5.2.0 or later, as stated by the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ZAC is an open-source, workflow-based Common Ground component for Dutch municipal case management. Prior to 5.2.0, by-id read endpoints in src/main/kotlin/nl/info/zac/app/zaak/ZaakRestService.kt omit assertPolicy(policyService.readZaakRechten(zaak).lezen) authorization. RequestAuthorizationFilter and hasAnyApplicationRole require only an application role on any zaaktype, not the target case's type, while zaak-rechten.rego enforces the actual zaaktype_allowed boundary only when invoked. An authenticated low-privileged municipal user who knows a case or decision UUID can use GET /rest/zaken/besluit/zaakUuid/{uuid} (listBesluitenForZaakUUID) to read decisions including types, dates, and free-text toelichting; GET /rest/zaken/besluit/{uuid}/historie (listBesluitHistorie) to read audit old/new values; and GET /rest/zaken/{uuid}/process-diagram (downloadProcessDiagram) to read BPMN workflow state across unauthorized zaaktypes. The advisory also identifies zaak/{uuid}/afzender (listAfzendersVoorZaak) as exposing zaaktype mailbox configuration without a policy check. The search/_zoek path is correctly authorization-filtered and is not part of this by-id read cluster. This issue is fixed in version 5.2.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-55551")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.