CVE-2026-54657 json
Open Zaak: /zaken/_zoek and /enkelvoudiginformatieobjecten/_zoek endpoints do not filter result lists based on authorizations linked to token
published 2026-10-16 23 d ago modified 2026-10-16 23 d ago also EUVD-2026-102899
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 18%
- public exploits
- 0
- none known
Summary
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter result querysets according to the authorizations associated with the request token. A caller with a valid zaken.lezen or documenten.lezen token can therefore retrieve case or document metadata outside the token's authorized types or confidentiality levels. Document searches require known UUIDs, and document content remains protected by separate download authorization. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.
Patch / fix
- github.com/open-zaak/open-zaak@15456f1 commit
- github.com/open-zaak/open-zaak@4b429d3 commit
- github.com/open-zaak/open-zaak@d3869af commit
- github.com/open-zaak/open-zaak/releases/tag/1.27.2 release
- github.com/open-zaak/open-zaak/releases/tag/1.28.2 release
- github.com/open-zaak/open-zaak/releases/tag/1.29.0 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 23 d ago
Exploit prediction
0.26% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected products
- open-zaak open-zaak
Classification
References
- github.com /open-zaak/open-zaak/commit/15456f1a0ef4b0abf1b1c0e3a16c99c15423b9fd
- github.com /open-zaak/open-zaak/commit/4b429d3243d1532f6fe731f932a201cf0ddc4c18
- github.com /open-zaak/open-zaak/commit/d3869af98c60570782f867bab3e1d14fd8d8330f
- github.com /open-zaak/open-zaak/security/advisories/GHSA-f29q-7rpr-jmjx
- github.com /open-zaak/open-zaak/releases/tag/1.27.2
- github.com /open-zaak/open-zaak/releases/tag/1.28.2
- github.com /open-zaak/open-zaak/releases/tag/1.29.0
Sources
- CVE List CVE-2026-54657
- NVD CVE-2026-54657
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.