CVE-2026-49462 Details
Description
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. In versions up to and including 3.0.0, deployments using the shipped default configuration exposed two GraphQL developer features without requiring authentication: the GraphiQL playground, an interactive UI for issuing GraphQL queries; and schema introspection, which lets a caller download the full description of every query, mutation, type, and argument the API supports. Anyone who could reach the `/graphiql` endpoint could open the playground in a browser, pull the full schema, and use that to map out the API and craft calls against it. By itself this does not leak user data, but it removes the guesswork from attacking the rest of the API and significantly lowers the bar for finding and exploiting other weaknesses. Version 3.0.1 patches the issue. As a workaround, override the two settings in deployed configuration.
A vulnerability in NL Portal Backend Libraries in versions through 3.0.0 allows unauthenticated access to GraphQL developer features. The default configuration exposes the GraphiQL playground and schema introspection without authentication. This vulnerability enables anyone with access to the '/graphiql' endpoint to open the playground, download the full API schema, and use it to map the API and craft calls. While this does not directly leak user data, it simplifies the process of finding and exploiting other weaknesses in the API.
Users can upgrade to version 3.0.1 or later, where the default configuration disables the GraphiQL playground and schema introspection. For those on the 1.x or 2.x release lines, which use Expedia GraphQL Kotlin, the default configuration also exposes the playground, but this version line will not receive the patch. Instead, users must manually disable the playground in the application's configuration file.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 11, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1188 | Initialization of a Resource with an Insecure Default | [email protected] |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NL Portal Backend Libraries | <= 3.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 11, 2026 | New CVE Received | [email protected] |