Read the docs
TI-2026-74865 Aliases CVE-2026-54683

Missing authorization in NL Portal Backend Libraries exposes documents

Priority MEDIUM 62CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

NL Portal Backend Libraries before 3.0.3 do not check document ownership when returning document contents through the getDocumentContent GraphQL query and a REST content route. Any authenticated portal user who knows another person's document identifier can read that document, which may contain sensitive personal information. The flaw is tracked as CWE-285.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. Prior to 3.0.3, both the getDocumentContent GraphQL query and GET /api/documentapi/{documentapi}/document/{documentId}/content REST route allow any authenticated portal user to retrieve a document without checking ownership of or another authorized relationship to it. A user with a valid login and another person's document identifier can read that document's contents, which may include sensitive personal information. Document identifiers are random and difficult to guess, but they can leak through other channels. This issue is fixed in version 3.0.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00423 36th percentileScored 2026-11-07
Fix Fixed nl-portal-backend-libraries (nl-portal): 3.0.3nl.nl-portal:documenten-api (Maven): 3.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nl-portalnl-portal-backend-librariesbefore 3.0.33.0.3Patch availableCNA
—nl.nl-portal:documenten-api (Maven)before 3.0.33.0.3Patch availableGHSA-jr45-52cw-69h5
  • nl-portal-backend-libraries Vendornl-portal Affected before 3.0.3 Fixed in 3.0.3 Patch available CNA
  • nl.nl-portal:documenten-api (Maven) Vendor— Affected before 3.0.3 Fixed in 3.0.3 Patch available GHSA-jr45-52cw-69h5

Remediation

The nl.nl-portal:documenten-api Maven package is fixed in version 3.0.3. The sources list no fixed version for nl-portal-backend-libraries.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA nl-portal-backend-libraries (nl-portal) Fixed in 3.0.3
  • Fix · GHSA-jr45-52cw-69h5 nl.nl-portal:documenten-api (Maven) Fixed in 3.0.3 Advisory →

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-54683
  2. 2026-10-16 Priority changed: MEDIUM → LOW
  3. 2026-10-28 CISA SSVC decision points changed
  4. 2026-10-28 Priority changed: LOW → MEDIUM

References

Other 7

  • TI-2026-74868 Server-side request forgery in NL Portal Backend Libraries CVSS 3.1MEDIUM 5.3
  • TI-2026-36619 NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak CVSS 3.1HIGH 8.1
  • TI-2026-36617 nl.nl-portal:app has GraphiQL UI and GraphQL schema introspection enabled by default CVSS 3.1MEDIUM 5.3
  • TI-2026-36618 NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences