ZAC: Missing per-zaaktype authorization on by-ID decision and process reads

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

ZAC is an open-source, workflow-based Common Ground component for Dutch municipal case management. Prior to 5.2.0, by-id read endpoints in src/main/kotlin/nl/info/zac/app/zaak/ZaakRestService.kt omit assertPolicy(policyService.readZaakRechten(zaak).lezen) authorization. RequestAuthorizationFilter and hasAnyApplicationRole require only an application role on any zaaktype, not the target case's type, while zaak-rechten.rego enforces the actual zaaktype_allowed boundary only when invoked. An authenticated low-privileged municipal user who knows a case or decision UUID can use GET /rest/zaken/besluit/zaakUuid/{uuid} (listBesluitenForZaakUUID) to read decisions including types, dates, and free-text toelichting; GET /rest/zaken/besluit/{uuid}/historie (listBesluitHistorie) to read audit old/new values; and GET /rest/zaken/{uuid}/process-diagram (downloadProcessDiagram) to read BPMN workflow state across unauthorized zaaktypes. The advisory also identifies zaak/{uuid}/afzender (listAfzendersVoorZaak) as exposing zaaktype mailbox configuration without a policy check. The search/_zoek path is correctly authorization-filtered and is not part of this by-id read cluster. This issue is fixed in version 5.2.0.

Etkilenen sürümler1 yazılım

Kaynaklar8 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…ponent/security/advisories/GHSA-cv9m-35q4-cxfm Diğer
• github.com/infonl/dimpact-zaakafhandelcomponent/pull/6225 Diğer
• github.com/infonl/dimpact-zaakafhandelcomponent/pull/6229 Diğer
• github.com/…ommit/7b90586be658cec9fa5c98c0838636237f40931f Diğer
• github.com/…ommit/d050f247301a1bcfb867015725a693c540a06f5a Diğer
• github.com/…pact-zaakafhandelcomponent/releases/tag/v5.2.0 Diğer

Kayıt geçmişi

1. 30 Eki 2026 19:48Yayımlandı

İlgili açıklar

• 7,5 CVE-2026-97638Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter
• 6,5 CVE-2026-119708abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Name
• 8,5 CVE-2026-61708SOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload Endpoint (customer_user)
• 9,0 CVE-2026-112905Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft
• 4,3 CVE-2026-119664Tamery (Conar) 0.26.1 before 0.99.0 Authorization Bypass via chatsMessages.update
• 4,3 CVE-2026-119663Tamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via connectionsResources.create