CVE-2026-54657: Open Zaak: /zaken/_zoek and /enkelvoudiginformatieobjecten/_zoek endpoints do not filter result lists based on authorizations linked to token
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/zoek do not filter result querysets according to the authorizations associated with the request token. A caller with a valid zaken.lezen or documenten.lezen token can therefore retrieve case or document metadata outside the token's authorized types or confidentiality levels. Document searches require known UUIDs, and document content remains protected by separate download authorization. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Open Zaakto a version that resolves this vulnerability.Fixed in 1.27.2 - Upgrade
Upgrade
Open Zaakto a version that resolves this vulnerability.Fixed in 1.28.2 - Upgrade
Upgrade
Open Zaakto a version that resolves this vulnerability.Fixed in 1.29.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a valid token with either zaken.lezen or documenten.lezen permission and network access to the affected POST search endpoint. No additional user interaction is required.
What information can be exposed?
A token holder can retrieve case or document metadata that falls outside the token's authorized case or document types and confidentiality levels. Document content is still protected by separate download authorization.
Are document searches equally easy to abuse as case searches?
No. Searches for enkelvoudiginformatieobjecten require known UUIDs, which limits document-metadata discovery compared with unrestricted result filtering.
Which deployments need updating?
Open Zaak versions from 1.0.0 through the affected releases should be updated to 1.27.2, 1.28.2, or 1.29.0, as applicable. Those versions contain the fix.