open-zaak vulnerabilities
CVEs whose affected-version data names the open-zaak package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-54657Medium· 6.5Open Zaak: /zaken/_zoek and /enkelvoudiginformatieobjecten/_zoek endpoints do not filter result lists based on authorizations linked to token
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_z…
▾ Sunlitopen-zaak · open-zaakvia CVEORG
CVE-2026-55836Medium· 6.8PoCOpen Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad)
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, _import_document_row in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandsp…
▾ Twilightopen-zaak · open-zaakvia CVEORG