Dimpact Zaakafhandelcomponent
Monthly
Dimpact ZAC prior to 5.2.0 exposes decision, audit-history, BPMN process-diagram, and afzender mailbox metadata for zaken outside a user's authorized zaaktypes to any authenticated low-privileged municipal user who knows a valid zaak or besluit UUID. The flaw is a cross-zaaktype IDOR (CWE-285/CWE-639) caused by missing assertPolicy checks on by-id read endpoints while the platform filter only requires an application role on any zaaktype; the advisory includes a local proof-of-concept reproduction (a public PoC reference exists; it is not verified as working exploit code). No CISA KEV active-exploitation confirmation is available, the impact is read-only confidentiality, and upgrading to 5.2.0 remediates; overall priority is moderate.
Dimpact ZAC prior to 5.2.0 exposes decision, audit-history, BPMN process-diagram, and afzender mailbox metadata for zaken outside a user's authorized zaaktypes to any authenticated low-privileged municipal user who knows a valid zaak or besluit UUID. The flaw is a cross-zaaktype IDOR (CWE-285/CWE-639) caused by missing assertPolicy checks on by-id read endpoints while the platform filter only requires an application role on any zaaktype; the advisory includes a local proof-of-concept reproduction (a public PoC reference exists; it is not verified as working exploit code). No CISA KEV active-exploitation confirmation is available, the impact is read-only confidentiality, and upgrading to 5.2.0 remediates; overall priority is moderate.