CVE-2026-49462
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
In versions up to and including 3.0.0, NL Portal Backend Libraries deployments using the shipped default configuration exposed two GraphQL developer features without authentication: the GraphiQL playground and schema introspection. Anyone able to reach the /graphiql endpoint could pull the full schema and use it to map out the API and craft calls against it. Version 3.0.1 patches the issue.
Risk Assessment
Exposing the full API schema significantly lowers the bar for attackers and makes it easier to find and exploit other weaknesses in the API, although it does not by itself leak user data.
Recommendation
Upgrade to version 3.0.1. As a workaround, override the two settings in the deployed configuration to disable the GraphiQL playground and schema introspection.
Other vulnerabilities in NL Portal Backend Libraries
See all- CVE-2026-55414Medium
In NL Portal Backend Libraries, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL resolvers are reachable without CommonGroundAuthentication and forward a caller-influenced URL through ObjectenApiService.getObjectByUrl to ObjectsApiClient.getObjectByUrl, which attaches the privileged Objecten-API token. The host-equality check restricts requests to the configured Objecten-API host but does not constrain the scheme, port, or path. The 3.0 line is fixed in 3.0.4; the advisory does not identify a fixed 3.1 release.
- CVE-2026-54683Medium
In NL Portal Backend Libraries, both the getDocumentContent GraphQL query and the GET /api/documentapi/{documentapi}/document/{documentId}/content REST route allow any authenticated portal user to retrieve a document without checking ownership of or another authorized relationship to it. A user with a valid login and another person's document identifier can read that document's contents, which may include sensitive personal information. Fixed in version 3.0.3.
- CVE-2026-49463Medium
The nl.nl-portal:documenten-api package (through 3.0.0) and nl.nl-portal:besluiten package (1.5.0 through 3.0.0) lack per-user authorization in GraphQL resolvers, allowing an authenticated user to access other users' document contents, decisions, audit trails, and decision attachments. Version 3.0.1 contains a patch.
Original NVD description (English source)
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. In versions up to and including 3.0.0, deployments using the shipped default configuration exposed two GraphQL developer features without requiring authentication: the GraphiQL playground, an interactive UI for issuing GraphQL queries; and schema introspection, which lets a caller download the full description of every query, mutation, type, and argument the API supports. Anyone who could reach the `/graphiql` endpoint could open the playground in a browser, pull the full schema, and use that to map out the API and craft calls against it. By itself this does not leak user data, but it removes the guesswork from attacking the rest of the API and significantly lowers the bar for finding and exploiting other weaknesses. Version 3.0.1 patches the issue. As a workaround, override the two settings in deployed configuration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS