Read the docs
TI-2026-36619 Aliases CVE-2026-49464GHSA-6h3c-r723-7fx3

NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak

Priority LOW 37CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:taak` package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the `submitTaakV2` GraphQL mutation, allowing an authenticated user who knows or guesses another user’s task ID to read its form data, overwrite its submitted data, and mark the task as completed. Version 3.0.1 contains a patch. As a workaround, block the `submitTaakV2` mutation at the API gateway or restrict the `/graphql` endpoint to trusted networks

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0035 28th percentileScored 2026-11-07
Fix Fixed nl-portal-backend-libraries (nl-portal): 3.0.1nl.nl-portal:taak (Maven): 3.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nl-portalnl-portal-backend-libraries1.5.0 to before 3.0.13.0.1Patch availableCNA
—nl.nl-portal:taak (Maven)1.5.0 to before 3.0.13.0.1Patch availableGHSA-6h3c-r723-7fx3
  • nl-portal-backend-libraries Vendornl-portal Affected 1.5.0 to before 3.0.1 Fixed in 3.0.1 Patch available CNA
  • nl.nl-portal:taak (Maven) Vendor— Affected 1.5.0 to before 3.0.1 Fixed in 3.0.1 Patch available GHSA-6h3c-r723-7fx3

Remediation

  • Fix · CNA nl-portal-backend-libraries (nl-portal) Fixed in 3.0.1
  • Fix · GHSA-6h3c-r723-7fx3 nl.nl-portal:taak (Maven) Fixed in 3.0.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49464
  2. 2026-10-03 Alias added: GHSA-6h3c-r723-7fx3

References

Other 2

  • TI-2026-74868 Server-side request forgery in NL Portal Backend Libraries CVSS 3.1MEDIUM 5.3
  • TI-2026-74865 Missing authorization in NL Portal Backend Libraries exposes documents CVSS 3.1MEDIUM 6.5
  • TI-2026-36617 nl.nl-portal:app has GraphiQL UI and GraphQL schema introspection enabled by default CVSS 3.1MEDIUM 5.3
  • TI-2026-36618 NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences