Read the docs
TI-2026-36618 Aliases CVE-2026-49463GHSA-qpm9-h556-mwxm

NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries

Priority LOW 29CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-285.

Summary

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:documenten-api` package through version 3.0.0 and the `nl.nl-portal:besluiten` package from version 1.5.0 through 3.0.0 lack per-user authorization in GraphQL resolvers, allowing an authenticated user to access other users’ document contents, decisions, audit trails, and decision attachments. Version 3.0.1 contains a patch. As a workaround, block the affected document-content and decision-related GraphQL operations at the API gateway or block their GraphQL types entirely.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0034 27th percentileScored 2026-11-07
Fix Fixed nl.nl-portal:besluiten (nl-portal): 3.0.1nl.nl-portal:documenten-api (nl-portal): 3.0.1+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nl-portalnl.nl-portal:besluiten1.5.0 to before 3.0.13.0.1Patch availableCNA
nl-portalnl.nl-portal:documenten-apibefore 3.0.13.0.1Patch availableCNA
—nl.nl-portal:documenten-api (Maven)before 3.0.13.0.1Patch availableGHSA-qpm9-h556-mwxm
—nl.nl-portal:besluiten (Maven)1.5.0 to before 3.0.13.0.1Patch availableGHSA-qpm9-h556-mwxm
  • nl.nl-portal:besluiten Vendornl-portal Affected 1.5.0 to before 3.0.1 Fixed in 3.0.1 Patch available CNA
  • nl.nl-portal:documenten-api Vendornl-portal Affected before 3.0.1 Fixed in 3.0.1 Patch available CNA
  • nl.nl-portal:documenten-api (Maven) Vendor— Affected before 3.0.1 Fixed in 3.0.1 Patch available GHSA-qpm9-h556-mwxm
  • nl.nl-portal:besluiten (Maven) Vendor— Affected 1.5.0 to before 3.0.1 Fixed in 3.0.1 Patch available GHSA-qpm9-h556-mwxm

Remediation

  • Fix · CNA nl.nl-portal:besluiten (nl-portal) Fixed in 3.0.1
  • Fix · CNA nl.nl-portal:documenten-api (nl-portal) Fixed in 3.0.1
  • Fix · GHSA-qpm9-h556-mwxm nl.nl-portal:documenten-api (Maven) Fixed in 3.0.1 Advisory →
  • Fix · GHSA-qpm9-h556-mwxm nl.nl-portal:besluiten (Maven) Fixed in 3.0.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49463
  2. 2026-10-03 Alias added: GHSA-qpm9-h556-mwxm

References

Other 2

  • TI-2026-74868 Server-side request forgery in NL Portal Backend Libraries CVSS 3.1MEDIUM 5.3
  • TI-2026-74865 Missing authorization in NL Portal Backend Libraries exposes documents CVSS 3.1MEDIUM 6.5
  • TI-2026-36619 NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak CVSS 3.1HIGH 8.1
  • TI-2026-36617 nl.nl-portal:app has GraphiQL UI and GraphQL schema introspection enabled by default CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences