CVE-2026-55551— ZAC: Missing per-zaaktype authorization on by-ID decision and process reads

Quick assessment

Affected

infonl dimpact-zaakafhandelcomponent

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ZAC 是一个开源的、基于工作流的通用基础（Common Ground）组件，用于荷兰市政部门的案件管理。在 5.2.0 版本之前，中按 ID 读取的端点遗漏了授权检查。和仅要求用户拥有任意案件类型（zaaktype）的应用角色，而非目标案件所属类型的角色；而策略文件仅在被调用时才对实际的边界进行强制检查。因此，一名已认证但权限较低且知晓案件或决定 UUID 的市政用户，可利用以下端点读取未授权案件类型中的信息：（）：读取决定信息，包括决定类型、日期及自由文本说明（toelichting）；（）

CVSS 6.5 · Medium Updated Oct 31, 2026

Possible ATT&CK Techniques 2 AI

T1086 T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ZAC: Missing per-zaaktype authorization on by-ID decision and process reads

Source: CVE Program / CVE List V5

Vulnerability Description

ZAC is an open-source, workflow-based Common Ground component for Dutch municipal case management. Prior to 5.2.0, by-id read endpoints in `src/main/kotlin/nl/info/zac/app/zaak/ZaakRestService.kt` omit `assertPolicy`(`policyService.readZaakRechten(zaak).lezen`) authorization. `RequestAuthorizationFilter` and `hasAnyApplicationRole` require only an application role on any zaaktype, not the target case's type, while `zaak-rechten.rego` enforces the actual `zaaktype_allowed` boundary only when invoked. An authenticated low-privileged municipal user who knows a case or decision UUID can use `GET /rest/zaken/besluit/zaakUuid/{uuid}` (`listBesluitenForZaakUUID`) to read decisions including types, dates, and free-text toelichting; `GET /rest/zaken/besluit/{uuid}/historie` (`listBesluitHistorie`) to read audit old/new values; and `GET /rest/zaken/{uuid}/process-diagram` (`downloadProcessDiagram`) to read BPMN workflow state across unauthorized zaaktypes. The advisory also identifies `zaak/{uuid}/afzender` (`listAfzendersVoorZaak`) as exposing zaaktype mailbox configuration without a policy check. The search/_zoek path is correctly authorization-filtered and is not part of this by-id read cluster. This issue is fixed in version 5.2.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
infonl	dimpact-zaakafhandelcomponent	< 5.2.0	-

II. Public POCs for CVE-2026-55551

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-55551

请登录查看更多情报信息。

Other References for CVE-2026-55551 (6)

https://github.com/infonl/dimpact-zaakafhandelcomponent/pull/6229 x_refsource_MISC
https://github.com/infonl/dimpact-zaakafhandelcomponent/pull/6225 x_refsource_MISC
https://github.com/infonl/dimpact-zaakafhandelcomponent/releases/tag/v5.2.0 x_refsource_MISC
https://github.com/infonl/dimpact-zaakafhandelcomponent/security/advisories/GHSA-cv9m-35q4-cxfm x_refsource_CONFIRM
https://github.com/infonl/dimpact-zaakafhandelcomponent/commit/7b90586be658cec9fa5c98c0838636237f40931f x_refsource_MISC
https://github.com/infonl/dimpact-zaakafhandelcomponent/commit/d050f247301a1bcfb867015725a693c540a06f5a x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-55551

IV. Related Vulnerabilities

Same weakness: CWE-285