CVE-2020-26251

CVE-2020-26251 describes a Cross-Origin Resource Sharing (CORS) misconfiguration in Open Zaak versions prior to 1.3.3, where the policy was overly permissive, allowing any client to make AJAX calls. This vulnerability affects the Open Zaak application, an open-source case management system. The vulnerability has a CVSS v3.1 score of 4.7 (Medium), indicating a network-based attack with high attack complexity and requiring user interaction, potentially leading to limited confidentiality and integrity impacts. However, several mitigating factors, such as Same-Site cookie policies, login protection for sensitive data, and disabled credentials in CORS, significantly reduce its actual exploitability. There is no evidence of active exploitation, exploit code availability (e.g., Metasploit, Nuclei, ExploitDB), or community discussion surrounding this CVE. The EPSS score is very low, and it is not listed on the CISA KEV catalog, suggesting a low likelihood of future exploitation.