CVE-2026-49463 Details
Description
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:documenten-api` package through version 3.0.0 and the `nl.nl-portal:besluiten` package from version 1.5.0 through 3.0.0 lack per-user authorization in GraphQL resolvers, allowing an authenticated user to access other users’ document contents, decisions, audit trails, and decision attachments. Version 3.0.1 contains a patch. As a workaround, block the affected document-content and decision-related GraphQL operations at the API gateway or block their GraphQL types entirely.
A vulnerability exists in the NL Portal Backend Libraries, specifically in the 'nl.nl-portal:documenten-api' package through version 3.0.0 and the 'nl.nl-portal:besluiten' package from version 1.5.0 through 3.0.0. These packages lack proper per-user authorization in their GraphQL resolvers, enabling authenticated users to access other users' document contents, decisions, audit trails, and decision attachments. The issue arises because the GraphQL resolvers were not configured to check user authentication, allowing unauthorized data access. This vulnerability could be exploited by enumerating decisions to discover document IDs and then accessing the corresponding document contents.
Users can upgrade to version 3.0.1 or later, where the vulnerability is patched. For the 'nl.nl-portal:documenten-api' package, the resolver now includes the authentication parameter, enabling proper user authorization checks. For the 'nl.nl-portal:besluiten' package, version 3.0.1 removes the entire 'besluiten' module, requiring consumers to implement a replacement with explicit per-user authorization before upgrading.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 11, 2026CISA-ADP
Assessed Sep 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-qpm9-h556-mwxm | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NL Portal Backend Libraries | All versions |
CPE
Remediation
| |
| NL Portal Documenten API | <= 3.0.0 (semver) |
CPE
Remediation
| |
| NL Portal Besluiten | >= 1.5.0, <= 3.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 11, 2026 | New CVE Received | [email protected] |
| Sep 11, 2026 | CVE Modified | CISA-ADP |