Open Zaak EUVD-2026-102899

Requires a valid OAuth/JWT API token carrying the zaken.lezen or documenten.lezen scope - exploitation is only possible for an already-authenticated API client (PR:L), not an anonymous caller. Once such a token is held, the zaken _zoek endpoint returns case metadata across case types and confidentiality levels the token was not authorized for, against default configurations of affected Open Zaak versions 1.0.0 through the fixes. LIMITING FACTORS: document (_zoek) searches only return results for UUIDs the attacker already knows, document content stays protected by a separate download authorization, and the disclosure is limited to metadata rather than full records - so impact is bounded to what a validly-tokenized but under-authorized client can enumerate.

This is a genuine but moderate-severity authorization flaw, not an overhyped high-CVSS issue. The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) describes a network-reachable, low-complexity bug whose only impact is confidentiality - there is no integrity or availability effect and scope is unchanged. The decisive limiting signal is PR:L: an attacker must already hold a valid zaken.lezen or documenten.lezen API token, so this is an insider / over-privileged-client / stolen-credential problem rather than an anonymous internet attack. No EPSS score, CISA KEV entry, or public proof-of-concept was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the realistic threat is targeted abuse by a legitimate but under-authorized API consumer rather than mass exploitation. SSVC-style reading: exploitation=none observed, automatable=yes for the zaken endpoint once a token is held (a single POST returns unauthorized results), technical impact=partial (metadata-only disclosure). The C:H rating is defensible because Dutch case metadata can include sensitive personal data subject to AVG/GDPR, but note the disclosure is metadata only - full document content remains protected by a separate download authorization, and document searches additionally require prior knowledge of UUIDs, both of which meaningfully cap real-world impact.

An authenticated API client (e.g. a connected municipal application, or an attacker who has obtained a leaked zaken.lezen or documenten.lezen token) issues a POST to /zaken/api/v1/zaken/_zoek and receives case metadata for case types and confidentiality levels its token was never authorized to see, enabling broad harvesting of sensitive case information. No public exploit code is known, but the attack requires only a standard search request with no special tooling. Document metadata can be similarly retrieved via the _zoek endpoint, though only for UUIDs the attacker already knows.