open-zaak CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM open-zaak CVE published 2026-10-16

CVE-2026-54657

Open Zaak, an open-source data and services layer for Dutch case-oriented working, has a vulnerability in its search endpoints. Versions from 1.0.0 until 1.27.2, 1.28.2, and 1.29.0 of the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter result querysets according to the authorizations associated with the request token. This allows a c [truncated]