CVE-2026-54683 Details
Description
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. Prior to 3.0.3, both the getDocumentContent GraphQL query and GET /api/documentapi/{documentapi}/document/{documentId}/content REST route allow any authenticated portal user to retrieve a document without checking ownership of or another authorized relationship to it. A user with a valid login and another person's document identifier can read that document's contents, which may include sensitive personal information. Document identifiers are random and difficult to guess, but they can leak through other channels. This issue is fixed in version 3.0.3.
A vulnerability in NL Portal Backend Libraries prior to version 3.0.3 allows authenticated users to access documents through the GraphQL 'getDocumentContent' query and a specific REST API route, without proper authorization checks. This could lead to unauthorized disclosure of sensitive personal information, as document IDs, while random and hard to guess, can be obtained through other means. The issue has been fully addressed in version 3.0.3 by removing the insecure GraphQL query and the problematic REST endpoint.
Users can upgrade to version 3.0.3 or later, where this vulnerability has been fixed. If an immediate upgrade is not possible, the vulnerable REST endpoint and GraphQL query can be blocked at the gateway or reverse proxy.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NL Portal Backend Libraries | < 3.0.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |