CVE-2026-54683
MediumCVSS 6.5Summary
In NL Portal Backend Libraries, both the getDocumentContent GraphQL query and the GET /api/documentapi/{documentapi}/document/{documentId}/content REST route allow any authenticated portal user to retrieve a document without checking ownership of or another authorized relationship to it. A user with a valid login and another person's document identifier can read that document's contents, which may include sensitive personal information. Fixed in version 3.0.3.
Risk Assessment
Unauthorized access to documents containing other people's sensitive personal information is possible. Document identifiers are random and difficult to guess, but they can leak through other channels.
Recommendation
Update NL Portal Backend Libraries to version 3.0.3 or later. Enforce ownership or authorized-relationship checks before returning document contents.
Other vulnerabilities in NL Portal Backend Libraries
See all- CVE-2026-55414Medium
In NL Portal Backend Libraries, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL resolvers are reachable without CommonGroundAuthentication and forward a caller-influenced URL through ObjectenApiService.getObjectByUrl to ObjectsApiClient.getObjectByUrl, which attaches the privileged Objecten-API token. The host-equality check restricts requests to the configured Objecten-API host but does not constrain the scheme, port, or path. The 3.0 line is fixed in 3.0.4; the advisory does not identify a fixed 3.1 release.
- CVE-2026-49463Medium
The nl.nl-portal:documenten-api package (through 3.0.0) and nl.nl-portal:besluiten package (1.5.0 through 3.0.0) lack per-user authorization in GraphQL resolvers, allowing an authenticated user to access other users' document contents, decisions, audit trails, and decision attachments. Version 3.0.1 contains a patch.
- CVE-2026-49462Medium
In versions up to and including 3.0.0, NL Portal Backend Libraries deployments using the shipped default configuration exposed two GraphQL developer features without authentication: the GraphiQL playground and schema introspection. Anyone able to reach the /graphiql endpoint could pull the full schema and use it to map out the API and craft calls against it. Version 3.0.1 patches the issue.
Original NVD description (English source)
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. Prior to 3.0.3, both the getDocumentContent GraphQL query and GET /api/documentapi/{documentapi}/document/{documentId}/content REST route allow any authenticated portal user to retrieve a document without checking ownership of or another authorized relationship to it. A user with a valid login and another person's document identifier can read that document's contents, which may include sensitive personal information. Document identifiers are random and difficult to guess, but they can leak through other channels. This issue is fixed in version 3.0.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS