Open Zaak: /zaken/_zoek and /enkelvoudiginformatieobjecten/_zoek endpoints do not filter result lists based on authorizations linked to token

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-54657 · Microsoft / collected KEV context

cve-program · CVE-2026-54657

• https://github.com/open-zaak/open-zaak/security/advisories/GHSA-f29q-7rpr-jmjx
• https://github.com/open-zaak/open-zaak/commit/15456f1a0ef4b0abf1b1c0e3a16c99c15423b9fd
• https://github.com/open-zaak/open-zaak/commit/4b429d3243d1532f6fe731f932a201cf0ddc4c18
• https://github.com/open-zaak/open-zaak/commit/d3869af98c60570782f867bab3e1d14fd8d8330f
• https://github.com/open-zaak/open-zaak/releases/tag/1.27.2
• https://github.com/open-zaak/open-zaak/releases/tag/1.28.2
• https://github.com/open-zaak/open-zaak/releases/tag/1.29.0

No related operational record is retained in the current change model.