---
id: CVE-2026-54657
title: >-
  Open Zaak: /zaken/_zoek and /enkelvoudiginformatieobjecten/_zoek endpoints do
  not filter result lists based on authorizations linked to token
summary: >-
  Open Zaak is an open-source data and services layer for Dutch case-oriented
  working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search
  endpoints /zaken/api/v1/zaken/_zoek and
  /documenten/api/v1/enkelvoudiginformatieobjecten/_z…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-285
  - CWE-639
vendor: open-zaak
product: open-zaak
affected:
  - 'open-zaak >= 1.0.0, < 1.27.2'
  - 'open-zaak >= 1.28.0, < 1.28.2'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T16:32:04.577772Z'
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T17:06:31.247Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-54657'
references:
  - url: >-
      https://github.com/open-zaak/open-zaak/security/advisories/GHSA-f29q-7rpr-jmjx
    label: >-
      https://github.com/open-zaak/open-zaak/security/advisories/GHSA-f29q-7rpr-jmjx
  - url: >-
      https://github.com/open-zaak/open-zaak/commit/15456f1a0ef4b0abf1b1c0e3a16c99c15423b9fd
    label: >-
      https://github.com/open-zaak/open-zaak/commit/15456f1a0ef4b0abf1b1c0e3a16c99c15423b9fd
  - url: >-
      https://github.com/open-zaak/open-zaak/commit/4b429d3243d1532f6fe731f932a201cf0ddc4c18
    label: >-
      https://github.com/open-zaak/open-zaak/commit/4b429d3243d1532f6fe731f932a201cf0ddc4c18
  - url: >-
      https://github.com/open-zaak/open-zaak/commit/d3869af98c60570782f867bab3e1d14fd8d8330f
    label: >-
      https://github.com/open-zaak/open-zaak/commit/d3869af98c60570782f867bab3e1d14fd8d8330f
  - url: 'https://github.com/open-zaak/open-zaak/releases/tag/1.27.2'
    label: 'https://github.com/open-zaak/open-zaak/releases/tag/1.27.2'
  - url: 'https://github.com/open-zaak/open-zaak/releases/tag/1.28.2'
    label: 'https://github.com/open-zaak/open-zaak/releases/tag/1.28.2'
  - url: 'https://github.com/open-zaak/open-zaak/releases/tag/1.29.0'
    label: 'https://github.com/open-zaak/open-zaak/releases/tag/1.29.0'
tags:
  - cve.org
ingestedAt: '2026-10-16T18:43:08.840Z'
---

## Overview

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter result querysets according to the authorizations associated with the request token. A caller with a valid zaken.lezen or documenten.lezen token can therefore retrieve case or document metadata outside the token's authorized types or confidentiality levels. Document searches require known UUIDs, and document content remains protected by separate download authorization. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.

## Affected

- `open-zaak >= 1.0.0, < 1.27.2`
- `open-zaak >= 1.28.0, < 1.28.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.