CVE-2020-26251

Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is allowed. This allows evil.com to run scripts that perform AJAX calls to known Open Zaak installations, and the browser will not block these. This was intended to only apply to development machines running on localhost/127.0.0.1. Open Zaak 1.3.3 disables CORS by default, while it can be opted-in through environment variables. The vulnerability does not actually seem exploitable because: a) The session cookie has a `Same-Site: Lax` policy which prevents it from being sent along in Cross-Origin requests. b) All pages that give access to (production) data are login-protected c) `Access-Control-Allow-Credentials` is set to `false` d) CSRF checks probably block the remote origin, since they're not explicitly added to the trusted allowlist.

• CWE-346
• CWE-346

• https://github.com/open-zaak/open-zaak/blob/master/CHANGELOG.rst#133-2020-12-17Release Notes, Third Party Advisory
• https://github.com/open-zaak/open-zaak/commit/952269269f1b629fce9c94485f83ac13f31d6c46Patch, Third Party Advisory
• https://github.com/open-zaak/open-zaak/security/advisories/GHSA-chhr-gxrg-64x7Third Party Advisory
• https://github.com/open-zaak/open-zaak/blob/master/CHANGELOG.rst#133-2020-12-17Release Notes, Third Party Advisory
• https://github.com/open-zaak/open-zaak/commit/952269269f1b629fce9c94485f83ac13f31d6c46Patch, Third Party Advisory
• https://github.com/open-zaak/open-zaak/security/advisories/GHSA-chhr-gxrg-64x7Third Party Advisory

Published

Dec 18, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26246Pimcore is an open source digital experience platform. In Pi…6.5
• CVE-2020-26247Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader p…4.3
• CVE-2020-26248In the PrestaShop module "productcomments" before version 4.…8.2
• CVE-2020-26249Red Discord Bot Dashboard is an easy-to-use interactive web …8.7
• CVE-2020-2625Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26250OAuthenticator is an OAuth login mechanism for JupyterHub. I…6.3
• CVE-2020-26252OpenMage is a community-driven alternative to Magento CE. In…7.2
• CVE-2020-26253Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3…5.9
• CVE-2020-26254omniauth-apple is the OmniAuth strategy for "Sign In with Ap…7.7
• CVE-2020-26255Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3…9.1
• CVE-2020-26256Fast-csv is an npm package for parsing and formatting CSVs o…6.5
• CVE-2020-26257Matrix is an ecosystem for open federated Instant Messaging …6.5