Dimpact ZAC EUVD-2026-114196

Requires (1) an authenticated ZAC account holding at least one application role on at least one zaaktype - i.e. any low-privileged municipal user, since RequestAuthorizationFilter/hasAnyApplicationRole does not check the target case's zaaktype - and (2) knowledge of a valid target zaak or besluit UUID, because the affected endpoints load strictly by id. Exploitation is limited to the by-id read cluster listBesluitenForZaakUUID (GET /rest/zaken/besluit/zaakUuid/{uuid}), listBesluitHistorie (GET /rest/zaken/besluit/{uuid}/historie), downloadProcessDiagram (GET /rest/zaken/{uuid}/process-diagram), and listAfzendersVoorZaak (zaak/{uuid}/afzender) on versions <= 5.1.0; the search/_zoek path is correctly authorization-filtered and is NOT affected. Limiting factors for defenders: valid credentials are mandatory, UUIDs are 128-bit and not readily guessable, impact is read-only confidentiality of decision/process/audit/mailbox metadata, and upgrading to 5.2.0 fully remediates.

This is a genuine but moderate-priority issue rather than a high-urgency emergency. The input CVSS is 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - network-reachable, low attack complexity, but requiring an authenticated low-privileged account and yielding confidentiality impact only (no integrity or availability loss). The vuln.today decision label is 'this_month', consistent with a steady patch priority rather than act_now/emergency. No EPSS score and no CISA KEV status were provided in the input, so there is no signal of widespread or active exploitation - treat exploitation likelihood as unquantified, not zero. A public PoC reference exists (the GHSA advisory documents a locally reproduced verification test showing policyService is never called); it is not verified as working weaponized exploit code. The most important real-world qualifier, which the raw CVSS does not capture, is that exploitation requires the attacker to already hold a valid municipal ZAC account AND to know a specific non-guessable case/besluit UUID; this makes the practical confidentiality exposure narrower than the input's C:H implies, which is why my independent assessment lowers C to Low. Net: a real broken-authorization (IDOR) defect worth patching on the vendor's 'this_month' cadence, but gated by authentication and per-case UUID knowledge rather than being an unauthenticated internet-wide risk.

An authenticated low-privileged municipal employee who legitimately works only certain case types (zaaktypen) obtains or guesses the UUID of a case outside their authorization scope and calls GET /rest/zaken/besluit/zaakUuid/{uuid}, /rest/zaken/besluit/{uuid}/historie, or /rest/zaken/{uuid}/process-diagram. Because these by-id read endpoints never invoke assertPolicy, the server returns decision details, free-text toelichting, audit old/new values, and BPMN workflow state for case types the user is not entitled to see. The GitHub advisory documents a reproduced verification test confirming the missing policy call, so a public PoC reference exists, though it is not distributed as turnkey exploit code.