infonl vulnerabilities

Products

• dimpact-zaakafhandelcomponent 1

Latest infonl CVEs

Newest publication first

1. CVE-2026-55551 ZAC: Missing per-zaaktype authorization on by-ID decision and process reads

   Published 2026-10-30

   Medium·CVSS 6.5 EPSS 0.26%

   ZAC is an open-source, workflow-based Common Ground component for Dutch municipal case management. Prior to 5.2.0, by-id read endpoints in src/main/kotlin/nl/info/zac/app/zaak/ZaakRestService.kt omit assertPolicy(policyService.readZaakRechten(zaak).lezen) authorization. RequestAu...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.