CVE-2026-54657

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/zoek do not filter result querysets according to the...

CVE-2026-55836

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, importdocumentrow in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains...

CVE-2026-55836

The Open Zaak data and services layer is vulnerable to path traversal and arbitrary server-file read in versions 1.13.0 through 1.27.2, 1.28.2, and 1.29.0. The root cause lies in the _import_document_row function within src/openzaak/components/documenten/tasks.py, which fails to validate that the...

EUVD-2026-102900

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, importdocumentrow in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains...

CVE-2026-55836 Open Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad)

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, importdocumentrow in src/openzaak/components/documenten/tasks.py uses the attacker-controlled bestandspad CSV field without ensuring that the resolved path remains...

CVE-2026-54657

The open-source data and services layer Open Zaak is vulnerable in versions 1.0.0 through 1.27.2, 1.28.2, and 1.29.0 . The POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek fail to filter result querysets based on the authorizations linked ...

CVE-2026-54657 Open Zaak: /zaken/_zoek and /enkelvoudiginformatieobjecten/_zoek endpoints do not filter result lists based on authorizations linked to token

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/zoek do not filter result querysets according to the...

EUVD-2026-102899

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/zoek do not filter result querysets according to the...

EUVD-2020-18847

Malware in sbrugna...

CVE-2020-26251

Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is allowed. This allows evil.com to run...

CVE-2020-26251

Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is allowed. This allows evil.com to run...

Cross site request forgery (csrf)

Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is allowed. This allows evil.com to run...

CVE-2020-26251 CORS configuration is possibly vulnerable

Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is allowed. This allows evil.com to run...

CVE-2020-26251

Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is allowed. This allows evil.com to run...

CVE-2020-26251

Open Zaak (version prior to 1.3.3) had a wide-open CORS policy allowing any client, which could enable cross-origin scripts to access the API. The CVE notes that Open Zaak 1.3.3 disables CORS by default, with opt-in possible via environment variables. The publicly provided documents state that ex...

CVE-2020-26251: Origin Validation Error

Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is allowed. This allows evil.com to run...

PT-2020-16378

Name of the Vulnerable Software and Affected Versions Open Zaak versions prior to 1.3.3 Description Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. The Cross-Origin-Resource-Sharing policy in Open Zaak is currently wid...

Open Zaak Access Control Error Vulnerability

Open Zaak is a Python-based data and service layer application from the Open Zaak team. The software can Zaakgericht Werken interact. Open Zaak before version 1.3.3 suffers from an Access Control Error vulnerability that stems from the fact that the cross-domain resource sharing policy is current...