---
cve: "CVE-2026-54657"
severity: "MEDIUM"
cvss: 6.5
epss: "0.3%"
vendor: "open-zaak"
kev: false
exploited: false
published: "2026-10-16 16:18:43"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-11-08T20:58:33+01:00"
---

# CVE-2026-54657

> 6.5 MEDIUM · 🧪 PoC

## Beschreibung

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter result querysets according to the authorizations associated with the request token. A caller with a valid zaken.lezen or documenten.lezen token can therefore retrieve case or document metadata outside the token's authorized types or confidentiality levels. Document searches require known UUIDs, and document content remains protected by separate download authorization. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GitHub_M**
- State: PUBLISHED
- Stand: 2026-10-16 17:06:31
- CNA-CVSS: **6.5** (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Keine | good |
| A Verfügbarkeit | Keine | good |

## Schwachstellen-Klasse

- **CWE-285** — Improper Authorization
  The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
- **CWE-639** — Authorization Bypass Through User-Controlled Key
  The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

## Angriffsmuster (CAPEC)

- [CAPEC-1 — Accessing Functionality Not Properly Constrained by ACLs](https://capec.mitre.org/data/definitions/1.html) _(Severity: High)_
- [CAPEC-13 — Subverting Environment Variable Values](https://capec.mitre.org/data/definitions/13.html) _(Severity: Very High)_
- [CAPEC-17 — Using Malicious Files](https://capec.mitre.org/data/definitions/17.html) _(Severity: Very High)_
- [CAPEC-39 — Manipulating Opaque Client-based Data Tokens](https://capec.mitre.org/data/definitions/39.html) _(Severity: Medium)_
- [CAPEC-45 — Buffer Overflow via Symbolic Links](https://capec.mitre.org/data/definitions/45.html) _(Severity: High)_
- [CAPEC-104 — Cross Zone Scripting](https://capec.mitre.org/data/definitions/104.html) _(Severity: High)_
- [CAPEC-127 — Directory Indexing](https://capec.mitre.org/data/definitions/127.html) _(Severity: Medium)_
- [CAPEC-402 — Bypassing ATA Password Security](https://capec.mitre.org/data/definitions/402.html)

## ATT&CK-Techniken

- [T1574.010 — Hijack Execution Flow: ServicesFile Permissions Weakness](https://attack.mitre.org/techniques/T1574/010/)
- [T1562.003 — Impair Defenses:Impair Command History Logging](https://attack.mitre.org/techniques/T1562/003/)
- [T1574.006 — Hijack Execution Flow:Dynamic Linker Hijacking](https://attack.mitre.org/techniques/T1574/006/)
- [T1574.007 — Hijack Execution Flow:Path Interception by PATH Environment ](https://attack.mitre.org/techniques/T1574/007/)
- [T1574.005 — Hijack Execution Flow: Executable Installer File Permissions](https://attack.mitre.org/techniques/T1574/005/)
- [T1083 — File and Directory Discovery](https://attack.mitre.org/techniques/T1083/)

## Patch verfügbar (OSV)

- 15456f1a0ef4b0abf1b1c0e3a16c99c15423b9fd (Commit)
- 4b429d3243d1532f6fe731f932a201cf0ddc4c18 (Commit)

## Referenzen

- <https://github.com/open-zaak/open-zaak/security/advisories/GHSA-f29q-7rpr-jmjx>
- <https://github.com/open-zaak/open-zaak/commit/15456f1a0ef4b0abf1b1c0e3a16c99c15423b9fd>
- <https://github.com/open-zaak/open-zaak/commit/4b429d3243d1532f6fe731f932a201cf0ddc4c18>
- <https://github.com/open-zaak/open-zaak/commit/d3869af98c60570782f867bab3e1d14fd8d8330f>
- <https://github.com/open-zaak/open-zaak/releases/tag/1.27.2>
- <https://github.com/open-zaak/open-zaak/releases/tag/1.28.2>
- <https://github.com/open-zaak/open-zaak/releases/tag/1.29.0>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-54657/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_