CVE-2026-55551

ZAC is an open-source, workflow-based Common Ground component for Dutch municipal case management. Prior to 5.2.0, by-id read endpoints in `src/main/kotlin/nl/info/zac/app/zaak/ZaakRestService.kt` omit `assertPolicy`(`policyService.readZaakRechten(zaak).lezen`) authorization. `RequestAuthorizationFilter` and `hasAnyApplicationRole` require only an application role on any zaaktype, not the target case's type, while `zaak-rechten.rego` enforces the actual `zaaktype_allowed` boundary only when invoked. An authenticated low-privileged municipal user who knows a case or decision UUID can use `GET /rest/zaken/besluit/zaakUuid/{uuid}` (`listBesluitenForZaakUUID`) to read decisions including types, dates, and free-text toelichting; `GET /rest/zaken/besluit/{uuid}/historie` (`listBesluitHistorie`) to read audit old/new values; and `GET /rest/zaken/{uuid}/process-diagram` (`downloadProcessDiagram`) to read BPMN workflow state across unauthorized zaaktypes. The advisory also identifies `zaak/{uuid}/afzender` (`listAfzendersVoorZaak`) as exposing zaaktype mailbox configuration without a policy check. The search/_zoek path is correctly authorization-filtered and is not part of this by-id read cluster. This issue is fixed in version 5.2.0.

• CWE-285
• CWE-639

• https://github.com/infonl/dimpact-zaakafhandelcomponent/commit/7b90586be658cec9fa5c98c0838636237f40931f
• https://github.com/infonl/dimpact-zaakafhandelcomponent/commit/d050f247301a1bcfb867015725a693c540a06f5a
• https://github.com/infonl/dimpact-zaakafhandelcomponent/pull/6225
• https://github.com/infonl/dimpact-zaakafhandelcomponent/pull/6229
• https://github.com/infonl/dimpact-zaakafhandelcomponent/releases/tag/v5.2.0
• https://github.com/infonl/dimpact-zaakafhandelcomponent/security/advisories/GHSA-cv9m-35q4-cxfm
• https://github.com/infonl/dimpact-zaakafhandelcomponent/security/advisories/GHSA-cv9m-35q4-cxfm

Published

Oct 30, 2026

Last Modified

Nov 6, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55546QWED-MCP is a deterministic verification gateway for MCP. Pr…9.8
• CVE-2026-55547Yamcs is a mission control framework. Prior to 5.12.8 and 5.…4.3
• CVE-2026-55548Yamcs is a mission control framework. Prior to 5.12.8 and 5.…4.3
• CVE-2026-55549Yamcs is a mission control framework. Prior to 5.9.4, Yamcs …6.5
• CVE-2026-5555A weakness has been identified in code-projects Concert Tick…7.3
• CVE-2026-55550NextCRM is open-source customer relationship management (CRM…7.1
• CVE-2026-55552Yamcs is a mission control framework. Prior to 5.11.13, Yamc…7.5
• CVE-2026-55553urllib is an HTTP client for Node.js that supports authentic…7.5
• CVE-2026-55554Dompdf is an HTML to PDF converter for PHP. In versions 3.15…7.5
• CVE-2026-55555Dompdf is an HTML to PDF converter for PHP. Versions 3.15 an…7.5
• CVE-2026-55556Rsyslog is a rocket-fast system for log processing. From 8.2…8.2
• CVE-2026-55557browse-mcp is a Playwright-based headless-browser MCP server…8.6