The vulnerability occurs because the POST search endpoints for cases and documents in Open Zaak do not apply the authorization rules linked to the request token. A caller possessing a valid read‑scope token can therefore receive metadata for cases or documents whose types or confidentiality levels are outside the token’s permissions. While document content remains protected by a separate download authorization, the exposed metadata may still contain sensitive information such as case identities or document titles, potentially aiding reconnaissance or further intrusion attempts. The weakness is a classic example of missing authorization checks (CWE‑285) compounded by improper information flow (CWE‑639).

End users deploying the open‑zaak service, specifically versions 1.0.0 up to and including the release just prior to 1.27.2, are affected. The issue was resolved in releases 1.27.2, 1.28.2, and 1.29.0; any deployment of those or newer releases is not vulnerable.

The CVSS score of 6.5 denotes moderate severity, reflecting that an attacker must first obtain a valid read token. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploitation at the time of analysis. The likely attack vector is via legitimate API usage: an attacker or compromised application that holds a read token can issue search requests and receive unauthorized metadata. The risk is chiefly the inadvertent disclosure of sensitive identifiers, rather than remote code execution or denial of service.