PT-2026-133685

CVE-2026-55551

Published

2026-10-30

Updated

2026-10-30

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ZAC versions prior to 5.2.0

Description An authorization bypass exists in the by-id read endpoints within src/main/kotlin/nl/info/zac/app/zaak/ZaakRestService.kt because they omit the assertPolicy(policyService.readZaakRechten(zaak).lezen) check. While RequestAuthorizationFilter and hasAnyApplicationRole verify a general application role, they do not validate the specific case type, and the zaak-rechten.rego policy is not invoked to enforce the zaaktype allowed boundary. Consequently, an authenticated low-privileged municipal user with a case or decision UUID can access unauthorized data through the following endpoints:

'/rest/zaken/besluit/zaakUuid/{uuid}' using listBesluitenForZaakUUID to read decisions, types, dates, and free-text toelichting.
'/rest/zaken/besluit/{uuid}/historie' using listBesluitHistorie to read audit old and new values.
'/rest/zaken/{uuid}/process-diagram' using downloadProcessDiagram to read BPMN workflow state.
'zaak/{uuid}/afzender' using listAfzendersVoorZaak to expose zaaktype mailbox configuration.

Recommendations Update ZAC to version 5.2.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key

CWE-285: Improper Authorization

Related identifiers