{"id":"CVE-2026-55551","kind":"vulnerability","aliases":["CVE-2026-55551"],"related":[],"title":"ZAC: case read endpoints skip authorization checks, exposing other case types","description":"ZAC is an open-source, workflow-based Common Ground component for Dutch municipal case management. Prior to 5.2.0, by-id read endpoints in `src/main/kotlin/nl/info/zac/app/zaak/ZaakRestService.kt` omit `assertPolicy`(`policyService.readZaakRechten(zaak).lezen`) authorization. `RequestAuthorizationFilter` and `hasAnyApplicationRole` require only an application role on any zaaktype, not the target case's type, while `zaak-rechten.rego` enforces the actual `zaaktype_allowed` boundary only when invoked. An authenticated low-privileged municipal user who knows a case or decision UUID can use `GET /rest/zaken/besluit/zaakUuid/{uuid}` (`listBesluitenForZaakUUID`) to read decisions including types, dates, and free-text toelichting; `GET /rest/zaken/besluit/{uuid}/historie` (`listBesluitHistorie`) to read audit old/new values; and `GET /rest/zaken/{uuid}/process-diagram` (`downloadProcessDiagram`) to read BPMN workflow state across unauthorized zaaktypes. The advisory also identifies `zaak/{uuid}/afzender` (`listAfzendersVoorZaak`) as exposing zaaktype mailbox configuration without a policy check. The search/_zoek path is correctly authorization-filtered and is not part of this by-id read cluster. This issue is fixed in version 5.2.0.","summary":"ZAC is a workflow case management component used by Dutch municipalities. Several by-ID REST endpoints for cases and decisions omit the policy check, so an authenticated low-privileged user who knows a case UUID can read decisions, audit history, workflow diagrams and mailbox configuration for case types they should not access.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["case-management","municipal","package","self-hosted","zac"],"not_affected_if":["single-zaaktype-deployment","version-5.2.0-or-later"],"how_to_check":"- Check the ZAC version in use; the sources say versions before `5.2.0` are affected.\n- Review whether users with only an application role can reach `/rest/zaken/besluit/zaakUuid/{uuid}`, `/rest/zaken/besluit/{uuid}/historie`, `/rest/zaken/{uuid}/process-diagram` and `/rest/zaken/{uuid}/afzender`.","fix":"- Upgrade ZAC to `5.2.0` or later, as stated by the sources.","status":"open","published_at":"2026-10-30T17:17:25+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","triaged_at":"2026-10-30T17:32:06+00:00","updated_at":"2026-10-30T17:32:06+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T17:32:06Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ZAC to `5.2.0` or later, as stated by the sources.","reach":"network","title":"ZAC: case read endpoints skip authorization checks, exposing other case types","impact":"medium","summary":"ZAC is a workflow case management component used by Dutch municipalities. Several by-ID REST endpoints for cases and decisions omit the policy check, so an authenticated low-privileged user who knows a case UUID can read decisions, audit history, workflow diagrams and mailbox configuration for case types they should not access.","audience":"businesses","category":"package","nicknames":[],"who_cares":["zac","case-management","municipal","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user reads decisions, audit history and workflow state across case types","analyst_note":"","how_to_check":"- Check the ZAC version in use; the sources say versions before `5.2.0` are affected.\n- Review whether users with only an application role can reach `/rest/zaken/besluit/zaakUuid/{uuid}`, `/rest/zaken/besluit/{uuid}/historie`, `/rest/zaken/{uuid}/process-diagram` and `/rest/zaken/{uuid}/afzender`.","plain_action":"","needs_analyst":false,"not_affected_if":["version-5.2.0-or-later","single-zaaktype-deployment"],"who_is_affected":"Municipalities and organisations running ZAC with several case types and users holding only an application role. The sources say the search endpoints are correctly filtered and not part of this flaw. Installations on `5.2.0` or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000758,"input_tokens":4539,"output_tokens":609,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-55551':14A,17A '/afzender':203C '/historie':176C '/process-diagram':187C '/rest/zaken':185C '/rest/zaken/besluit':174C '/rest/zaken/besluit/zaakuuid':159C '5.2.0':100C,239C 'access':80B 'across':194C 'actual':135C 'advisori':198C 'allow':137C 'also':199C 'applic':120C 'assertpolici':109C 'audit':67B,180C 'authent':54B,143C 'author':6A,113C,220C 'authorization-filt':219C 'base':89C 'boundari':138C 'bpmn':191C 'by-id':39B,101C,228C 'case':2A,10A,19B,31B,45B,62B,75B,96C,128C,152C 'case-manag':18B 'check':7A,51B,213C 'cluster':232C 'common':90C 'compon':33B,92C 'configur':73B,209C 'correct':218C 'cve':12A,15A 'date':167C 'decis':47B,66B,154C,164C 'diagram':70B 'downloadprocessdiagram':188C 'dutch':36B,94C 'endpoint':4A,43B,105C 'enforc':133C 'expos':8A,206C 'filter':221C 'fix':236C 'free':170C 'free-text':169C 'get':158C,173C,184C 'ground':91C 'hasanyapplicationrol':116C 'histori':68B 'host':25B 'id':41B,103C,230C 'identifi':200C 'includ':165C 'invok':141C 'issu':234C 'know':60B,150C 'lezen':112C 'listafzendersvoorzaak':204C 'listbesluitenforzaakuuid':161C 'listbesluithistori':177C 'low':56B,145C 'low-privileg':55B,144C 'mailbox':72B,208C 'manag':20B,32B,97C 'municip':21B,37B,95C,147C 'old/new':181C 'omit':48B,108C 'open':85C 'open-sourc':84C 'packag':22B 'part':225C 'path':216C 'polici':50B,212C 'policyservice.readzaakrechten':110C 'prior':98C 'privileg':57B,146C 'read':3A,65B,104C,163C,179C,190C,231C 'requestauthorizationfilt':114C 'requir':117C 'rest':42B 'role':121C 'search/_zoek':215C 'self':24B 'self-host':23B 'sever':38B 'skip':5A 'sourc':86C 'src/main/kotlin/nl/info/zac/app/zaak/zaakrestservice.kt':107C 'state':193C 'target':127C 'text':171C 'toelicht':172C 'type':11A,76B,130C,166C 'unauthor':195C 'use':34B,157C 'user':58B,148C 'uuid':63B,155C,160C,175C,186C,202C 'valu':182C 'version':238C 'without':210C 'workflow':30B,69B,88C,192C 'workflow-bas':87C 'zaak':111C,201C 'zaak-rechten.rego':132C 'zaaktyp':124C,136C,196C,207C 'zac':1A,26B,27B,81C","nicknames":[],"mitigations":[],"who_affected":"Municipalities and organisations running ZAC with several case types and users holding only an application role. The sources say the search endpoints are correctly filtered and not part of this flaw. Installations on `5.2.0` or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T17:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-55551","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55551","severity":null,"published_at":"2026-10-30T17:17:25+00:00","modified_at":"2026-10-30T17:17:25+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","fetched_at":"2026-10-30T17:31:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}