CVE-2026-54657

🗓️ 16 Oct 2026 15:21:57Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 30 Views🌐 WEB

Open Zaak search endpoints do not filter results based on token authorizations.

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2026-54657	16 Oct 202615:27	–	circl
CNNVD	Open Zaak Authorization Issue Vulnerability	15 Oct 202616:00	–	cnnvd
Cvelist	CVE-2026-54657 Open Zaak: /zaken/_zoek and /enkelvoudiginformatieobjecten/_zoek endpoints do not filter result lists based on authorizations linked to token	16 Oct 202615:21	–	cvelist
EUVD	EUVD-2026-102899	16 Oct 202615:21	–	euvd
Mend	CVE-2026-54657	16 Oct 202615:21	–	mend
NVD	CVE-2026-54657	16 Oct 202616:18	–	nvd
Positive Technologies	PT-2026-107517	7 Oct 202600:00	–	ptsecurity
Positive Technologies	PT-2026-107518	7 Oct 202600:00	–	ptsecurity
Positive Technologies	PT-2026-107519	7 Oct 202600:00	–	ptsecurity
Positive Technologies	PT-2026-107520	7 Oct 202600:00	–	ptsecurity

Vulners

Node

openzaak open_zaakRange1.0.0–1.27.2

openzaak open_zaakRange1.28.0–1.28.2

[
  {
    "vendor": "open-zaak",
    "product": "open-zaak",
    "versions": [
      {
        "version": ">= 1.0.0, < 1.27.2",
        "status": "affected"
      },
      {
        "version": ">= 1.28.0, < 1.28.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/open-zaak/open-zaak/security/advisories/GHSA-f29q-7rpr-jmjx
github	www.github.com/open-zaak/open-zaak/commit/15456f1a0ef4b0abf1b1c0e3a16c99c15423b9fd
github	www.github.com/open-zaak/open-zaak/commit/4b429d3243d1532f6fe731f932a201cf0ddc4c18
github	www.github.com/open-zaak/open-zaak/releases/tag/1.27.2
github	www.github.com/open-zaak/open-zaak/releases/tag/1.28.2
github	www.github.com/open-zaak/open-zaak/releases/tag/1.29.0
github	www.github.com/open-zaak/open-zaak/commit/d3869af98c60570782f867bab3e1d14fd8d8330f

Parameter	Position	Path	Description	CWE
search query	request body	/zaken/api/v1/zaken/_zoek	The POST search endpoint does not filter result querysets according to the authorizations associated with the request token, allowing unauthorized access to case metadata.	CWE-285, CWE-639
search query	request body	/documenten/api/v1/enkelvoudiginformatieobjecten/_zoek	The POST search endpoint does not filter result querysets according to the authorizations associated with the request token, allowing unauthorized access to document metadata.	CWE-285, CWE-639

16 Oct 2026 20:04Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.5

EPSS0.00263

SSVC