CVE-2026-55551

ZAC is an open-source, workflow-based Common Ground component for Dutch municipal case management. Prior to 5.2.0, by-id read endpoints in src/main/kotlin/nl/info/zac/app/zaak/ZaakRestService.kt omit assertPolicypolicyService.readZaakRechtenzaak.lezen authorization. RequestAuthorizationFilter and...

EUVD-2026-114196

ZAC is an open-source, workflow-based Common Ground component for Dutch municipal case management. Prior to 5.2.0, by-id read endpoints in src/main/kotlin/nl/info/zac/app/zaak/ZaakRestService.kt omit assertPolicypolicyService.readZaakRechtenzaak.lezen authorization. RequestAuthorizationFilter and...

CVE-2026-55551

The ZAC open-source workflow component for Dutch municipal case management is vulnerable to an improper authorization flaw in versions prior to 5.2.0 . The ZaakRestService.kt file omits necessary assertPolicy checks on by-id read endpoints. Consequently, an authenticated low-privileged user who k...

CVE-2026-55551 ZAC: Missing per-zaaktype authorization on by-ID decision and process reads

ZAC is an open-source, workflow-based Common Ground component for Dutch municipal case management. Prior to 5.2.0, by-id read endpoints in src/main/kotlin/nl/info/zac/app/zaak/ZaakRestService.kt omit assertPolicypolicyService.readZaakRechtenzaak.lezen authorization. RequestAuthorizationFilter and...

CVE-2026-55551: infonl dimpact-zaakafhandelcomponent: ZAC is an open-source, workflow-based Common Ground component for Dutch municipal case management

ZAC is an open-source, workflow-based Common Ground component for Dutch municipal case management. Prior to 5.2.0, by-id read endpoints in src/main/kotlin/nl/info/zac/app/zaak/ZaakRestService.kt omit assertPolicypolicyService.readZaakRechtenzaak.lezen authorization. RequestAuthorizationFilter and...