SZB-f797722055
infonl ZAC by-id read endpoints missing policy check (EUVD-2026-114196)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- infonl
- Product
- ZAC (dimpact-zaakafhandelcomponent)
- First seen
Summary
The EU Vulnerability Database lists a flaw in infonl's ZAC case management component, scored 6.5 (CVSS v3.1). The listing says by-id read endpoints in ZaakRestService.kt omit a policy assertion in versions before 5.2.0.
If you use infonl
Upgrade ZAC to version 5.2.0 or later
Review access logs for by-id requests to case endpoints
Confirm that case access policies are enforced after upgrading
What the sources say 1
· Mastodon: “Prior to 5.2.0, by-id read endpoints in `src/main/kotlin/nl/info/zac/app/zaak/ZaakRestService.kt` omit `assertPolicy`(`policyService.rea...” Source