CVE-2026-49464 Details
Description
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:taak` package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the `submitTaakV2` GraphQL mutation, allowing an authenticated user who knows or guesses another user’s task ID to read its form data, overwrite its submitted data, and mark the task as completed. Version 3.0.1 contains a patch. As a workaround, block the `submitTaakV2` mutation at the API gateway or restrict the `/graphql` endpoint to trusted networks
An authorization bypass vulnerability has been identified in the `nl.nl-portal:taak` package of NL Portal Backend Libraries, affecting versions 1.5.0 through 3.0.0. The vulnerability arises in the `submitTaakV2` GraphQL mutation, where the ownership of tasks is not properly verified. This flaw enables an authenticated user to manipulate another user's task by reading, overwriting, and marking it as completed. The issue stems from the task submission endpoint, which accepted task IDs and payloads without verifying if the task belonged to the user making the request. As a result, personal data could be leaked, and the integrity of submitted information was compromised.
Users are advised to upgrade to version 3.0.1 or later. If an immediate upgrade is not possible, the `submitTaakV2` mutation can be blocked at the API gateway, or the `/graphql` endpoint can be restricted to trusted networks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 11, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-6h3c-r723-7fx3 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NL Portal Backend Libraries | All versions |
CPE
Remediation
| |
| nl.nl-portal:taak | >= 1.5.0, <= 3.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 11, 2026 | New CVE Received | [email protected] |