Vulnerability · Published Sep 11, 2026 · Assigned by GitHub_M
CVE-2026-49463NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries
Medium 6.5
In plain English
A medium-severity information exposure in nl.nl-portal:besluiten from nl-portal. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:documenten-api` package through version 3.0.0 and the `nl.nl-portal:besluiten` package from version 1.5.0 through 3.0.0 lack per-user authorization in GraphQL resolvers, allowing an authenticated user to access other users’ document contents, decisions, audit trails, and decision attachments. Version 3.0.1 contains a patch. As a workaround, block the affected document-content and decision-related GraphQL operations at the API gateway or block their GraphQL types entirely.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | nl.nl-portal:besluiten | 3.0.1 | GHSA-qpm9-h556-mwxm |
| Maven | nl.nl-portal:documenten-api | 3.0.1 | GHSA-qpm9-h556-mwxm |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nl-portal | nl.nl-portal:besluiten | >= 1.5.0, < 3.0.1 |
| nl-portal | nl.nl-portal:documenten-api | < 3.0.1 |
Weakness: CWE-200, CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N