ZAC: Missing per-zaaktype authorization on by-ID decision and process reads
Summary
| CVE | CVE-2026-55551 |
|---|---|
| State | PUBLISHED |
| Assigner | GitHub_M |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-30 17:17:25 UTC |
| Updated | 2026-11-06 17:18:29 UTC |
| Description | ZAC is an open-source, workflow-based Common Ground component for Dutch municipal case management. Prior to 5.2.0, by-id read endpoints in `src/main/kotlin/nl/info/zac/app/zaak/ZaakRestService.kt` omit `assertPolicy`(`policyService.readZaakRechten(zaak).lezen`) authorization. `RequestAuthorizationFilter` and `hasAnyApplicationRole` require only an application role on any zaaktype, not the target case's type, while `zaak-rechten.rego` enforces the actual `zaaktype_allowed` boundary only when invoked. An authenticated low-privileged municipal user who knows a case or decision UUID can use `GET /rest/zaken/besluit/zaakUuid/{uuid}` (`listBesluitenForZaakUUID`) to read decisions including types, dates, and free-text toelichting; `GET /rest/zaken/besluit/{uuid}/historie` (`listBesluitHistorie`) to read audit old/new values; and `GET /rest/zaken/{uuid}/process-diagram` (`downloadProcessDiagram`) to read BPMN workflow state across unauthorized zaaktypes. The advisory also identifies `zaak/{uuid}/afzender` (`listAfzendersVoorZaak`) as exposing zaaktype mailbox configuration without a policy check. The search/_zoek path is correctly authorization-filtered and is not part of this by-id read cluster. This issue is fixed in version 5.2.0. |
Risk And Classification
Primary CVSS: v3.1 6.5 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.002570000 probability, percentile 0.174910000 (date 2026-11-07)
Problem Types: CWE-285 | CWE-639 | CWE-285 CWE-285: Improper Authorization | CWE-639 CWE-639: Authorization Bypass Through User-Controlled Key
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | CNA | DECLARED | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Infonl | Dimpact-zaakafhandelcomponent | affected < 5.2.0 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/infonl/dimpact-zaakafhandelcomponent/releases/tag/v5.2.0 | [email protected] | github.com | |
| github.com/infonl/dimpact-zaakafhandelcomponent/pull/6229 | [email protected] | github.com | |
| github.com/infonl/dimpact-zaakafhandelcomponent/commit/7b90586be658cec9f... | [email protected] | github.com | |
| github.com/infonl/dimpact-zaakafhandelcomponent/security/advisories/GHSA... | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | github.com | |
| github.com/infonl/dimpact-zaakafhandelcomponent/commit/d050f247301a1bcfb... | [email protected] | github.com | |
| github.com/infonl/dimpact-zaakafhandelcomponent/pull/6225 | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.