Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-55414 (GCVE-0-2026-55414)

Vulnerability from nvd – Published: 2026-10-15 17:33 – Updated: 2026-10-15 18:26

Title

NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)

Summary

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL resolvers are reachable without CommonGroundAuthentication and forward a caller-influenced URL through ObjectenApiService.getObjectByUrl to ObjectsApiClient.getObjectByUrl, which attaches the privileged Objecten-API token. The host-equality check restricts requests to the configured Objecten-API host but does not constrain the scheme, port, or path, allowing an unauthenticated caller to induce a token-bearing request to a chosen endpoint on that host. Standard deployments are not exposed to cross-host SSRF, token capture requires attacker-controlled routing on the configured host, and typed deserialization limits returned data to objects shaped like form definitions. The 3.0 release line is fixed in version 3.0.4. The advisory does not identify a fixed 3.1 release.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 18:25 UTC

CWE

CWE-862 - Missing Authorization
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7819 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_CONFIRM
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_MISC
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_MISC
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nl-portal	nl-portal-backend-libraries	Affected: >= 1.1.0, < 3.0.4 Affected: = 3.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55414",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T18:25:48.650492Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T18:26:10.056Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-xm3x-9cfw-jhx4"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nl-portal-backend-libraries",
          "vendor": "nl-portal",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.1.0, \u003c 3.0.4"
            },
            {
              "status": "affected",
              "version": "= 3.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL resolvers are reachable without CommonGroundAuthentication and forward a caller-influenced URL through ObjectenApiService.getObjectByUrl to ObjectsApiClient.getObjectByUrl, which attaches the privileged Objecten-API token. The host-equality check restricts requests to the configured Objecten-API host but does not constrain the scheme, port, or path, allowing an unauthenticated caller to induce a token-bearing request to a chosen endpoint on that host. Standard deployments are not exposed to cross-host SSRF, token capture requires attacker-controlled routing on the configured host, and typed deserialization limits returned data to objects shaped like form definitions. The 3.0 release line is fixed in version 3.0.4. The advisory does not identify a fixed 3.1 release."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T17:33:04.629Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-xm3x-9cfw-jhx4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-xm3x-9cfw-jhx4"
        },
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/pull/700",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/pull/700"
        },
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/commit/5ea04ef6445443e22e40a23fbed447e618b70c3f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/commit/5ea04ef6445443e22e40a23fbed447e618b70c3f"
        },
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/releases/tag/3.0.4.RELEASE",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/releases/tag/3.0.4.RELEASE"
        }
      ],
      "source": {
        "advisory": "GHSA-xm3x-9cfw-jhx4",
        "discovery": "UNKNOWN"
      },
      "title": "NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55414",
    "datePublished": "2026-10-15T17:33:04.629Z",
    "dateReserved": "2026-06-16T21:48:43.125Z",
    "dateUpdated": "2026-10-15T18:26:10.056Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54683 (GCVE-0-2026-54683)

Vulnerability from nvd – Published: 2026-10-15 17:31 – Updated: 2026-10-15 17:31

Title

NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user until 3.0.3 (incomplete fix of CVE-2026-49463)

Summary

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. Prior to 3.0.3, both the getDocumentContent GraphQL query and GET /api/documentapi/{documentapi}/document/{documentId}/content REST route allow any authenticated portal user to retrieve a document without checking ownership of or another authorized relationship to it. A user with a valid login and another person's document identifier can read that document's contents, which may include sensitive personal information. Document identifiers are random and difficult to guess, but they can leak through other channels. This issue is fixed in version 3.0.3.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-285 - Improper Authorization
CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7819 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_CONFIRM
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_MISC
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_MISC
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_MISC
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_MISC
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nl-portal	nl-portal-backend-libraries	Affected: < 3.0.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "nl-portal-backend-libraries",
          "vendor": "nl-portal",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. Prior to 3.0.3, both the getDocumentContent GraphQL query and GET /api/documentapi/{documentapi}/document/{documentId}/content REST route allow any authenticated portal user to retrieve a document without checking ownership of or another authorized relationship to it. A user with a valid login and another person\u0027s document identifier can read that document\u0027s contents, which may include sensitive personal information. Document identifiers are random and difficult to guess, but they can leak through other channels. This issue is fixed in version 3.0.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T17:31:02.449Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-jr45-52cw-69h5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-jr45-52cw-69h5"
        },
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/pull/684",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/pull/684"
        },
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/pull/690",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/pull/690"
        },
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/commit/6e738a876ff9f581991b5b070706100b5516e183",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/commit/6e738a876ff9f581991b5b070706100b5516e183"
        },
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/commit/e326e6db862f71f76dd46d3b17cbb5fa6f2fba02",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/commit/e326e6db862f71f76dd46d3b17cbb5fa6f2fba02"
        },
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/releases/tag/3.0.3.RELEASE",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/releases/tag/3.0.3.RELEASE"
        }
      ],
      "source": {
        "advisory": "GHSA-jr45-52cw-69h5",
        "discovery": "UNKNOWN"
      },
      "title": "NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user until 3.0.3 (incomplete fix of CVE-2026-49463)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54683",
    "datePublished": "2026-10-15T17:31:02.449Z",
    "dateReserved": "2026-06-15T22:53:58.561Z",
    "dateUpdated": "2026-10-15T17:31:02.449Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-49464 (GCVE-0-2026-49464)

Vulnerability from nvd – Published: 2026-09-11 20:34 – Updated: 2026-09-15 16:36

Title

NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak

Summary

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:taak` package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the `submitTaakV2` GraphQL mutation, allowing an authenticated user who knows or guesses another user’s task ID to read its form data, overwrite its submitted data, and mark the task as completed. Version 3.0.1 contains a patch. As a workaround, block the `submitTaakV2` mutation at the API gateway or restrict the `/graphql` endpoint to trusted networks

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 16:35 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7819 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
nl-portal	nl-portal-backend-libraries	Affected: >= 1.5.0, < 3.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49464",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T16:35:22.103984Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T16:36:50.488Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nl-portal-backend-libraries",
          "vendor": "nl-portal",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.5.0, \u003c 3.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:taak` package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the `submitTaakV2` GraphQL mutation, allowing an authenticated user who knows or guesses another user\u2019s task ID to read its form data, overwrite its submitted data, and mark the task as completed. Version 3.0.1 contains a patch. As a workaround, block the `submitTaakV2` mutation at the API gateway or restrict the `/graphql` endpoint to trusted networks"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T20:34:14.230Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-6h3c-r723-7fx3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-6h3c-r723-7fx3"
        }
      ],
      "source": {
        "advisory": "GHSA-6h3c-r723-7fx3",
        "discovery": "UNKNOWN"
      },
      "title": "NL Portal: IDOR allows any authenticated user to complete and tamper with another user\u0027s taak"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49464",
    "datePublished": "2026-09-11T20:34:14.230Z",
    "dateReserved": "2026-05-30T04:17:43.094Z",
    "dateUpdated": "2026-09-15T16:36:50.488Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-49463 (GCVE-0-2026-49463)

Vulnerability from nvd – Published: 2026-09-11 19:29 – Updated: 2026-09-11 19:51

Title

NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries

Summary

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:documenten-api` package through version 3.0.0 and the `nl.nl-portal:besluiten` package from version 1.5.0 through 3.0.0 lack per-user authorization in GraphQL resolvers, allowing an authenticated user to access other users’ document contents, decisions, audit trails, and decision attachments. Version 3.0.1 contains a patch. As a workaround, block the affected document-content and decision-related GraphQL operations at the API gateway or block their GraphQL types entirely.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-11 19:51 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-285 - Improper Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7819 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_CONFIRM

Impacted products

2 products

Vendor	Product	Version
nl-portal	nl.nl-portal:besluiten	Affected: >= 1.5.0, < 3.0.1
nl-portal	nl.nl-portal:documenten-api	Affected: < 3.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49463",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T19:51:06.683901Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T19:51:13.582Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nl.nl-portal:besluiten",
          "vendor": "nl-portal",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.5.0, \u003c 3.0.1"
            }
          ]
        },
        {
          "product": "nl.nl-portal:documenten-api",
          "vendor": "nl-portal",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:documenten-api` package through version 3.0.0 and the `nl.nl-portal:besluiten` package from version 1.5.0 through 3.0.0 lack per-user authorization in GraphQL resolvers, allowing an authenticated user to access other users\u2019 document contents, decisions, audit trails, and decision attachments. Version 3.0.1 contains a patch. As a workaround, block the affected document-content and decision-related GraphQL operations at the API gateway or block their GraphQL types entirely."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T19:51:33.853Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-qpm9-h556-mwxm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-qpm9-h556-mwxm"
        }
      ],
      "source": {
        "advisory": "GHSA-qpm9-h556-mwxm",
        "discovery": "UNKNOWN"
      },
      "title": "NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49463",
    "datePublished": "2026-09-11T19:29:56.465Z",
    "dateReserved": "2026-05-30T04:17:43.094Z",
    "dateUpdated": "2026-09-11T19:51:33.853Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-49462 (GCVE-0-2026-49462)

Vulnerability from nvd – Published: 2026-09-11 19:53 – Updated: 2026-09-14 16:19

Title

nl.nl-portal:app has GraphiQL UI and GraphQL schema introspection enabled by default

Summary

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. In versions up to and including 3.0.0, deployments using the shipped default configuration exposed two GraphQL developer features without requiring authentication: the GraphiQL playground, an interactive UI for issuing GraphQL queries; and schema introspection, which lets a caller download the full description of every query, mutation, type, and argument the API supports. Anyone who could reach the `/graphiql` endpoint could open the playground in a browser, pull the full schema, and use that to map out the API and craft calls against it. By itself this does not leak user data, but it removes the guesswork from attacking the rest of the API and significantly lowers the bar for finding and exploiting other weaknesses. Version 3.0.1 patches the issue. As a workaround, override the two settings in deployed configuration.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 16:19 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-1188 - Insecure Default Initialization of Resource

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7819 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_CONFIRM
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nl-portal	nl.nl-portal:app	Affected: < 3.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49462",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T16:19:32.111645Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T16:19:42.885Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nl.nl-portal:app",
          "vendor": "nl-portal",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. In versions up to and including 3.0.0, deployments using the shipped default configuration exposed two GraphQL developer features without requiring authentication: the GraphiQL playground, an interactive UI for issuing GraphQL queries; and schema introspection, which lets a caller download the full description of every query, mutation, type, and argument the API supports. Anyone who could reach the `/graphiql` endpoint could open the playground in a browser, pull the full schema, and use that to map out the API and craft calls against it. By itself this does not leak user data, but it removes the guesswork from attacking the rest of the API and significantly lowers the bar for finding and exploiting other weaknesses. Version 3.0.1 patches the issue. As a workaround, override the two settings in deployed configuration."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1188",
              "description": "CWE-1188: Insecure Default Initialization of Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T19:53:04.298Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-9m9w-2vqr-m384",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-9m9w-2vqr-m384"
        },
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/commit/0d2af7665a737e91565352bd4e6124cacaa853b7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/commit/0d2af7665a737e91565352bd4e6124cacaa853b7"
        }
      ],
      "source": {
        "advisory": "GHSA-9m9w-2vqr-m384",
        "discovery": "UNKNOWN"
      },
      "title": "nl.nl-portal:app has GraphiQL UI and GraphQL schema introspection enabled by default"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49462",
    "datePublished": "2026-09-11T19:53:04.298Z",
    "dateReserved": "2026-05-30T04:17:43.094Z",
    "dateUpdated": "2026-09-14T16:19:42.885Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55414 (GCVE-0-2026-55414)

Vulnerability from cvelistv5 – Published: 2026-10-15 17:33 – Updated: 2026-10-15 18:26

Title

NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)

Summary

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL resolvers are reachable without CommonGroundAuthentication and forward a caller-influenced URL through ObjectenApiService.getObjectByUrl to ObjectsApiClient.getObjectByUrl, which attaches the privileged Objecten-API token. The host-equality check restricts requests to the configured Objecten-API host but does not constrain the scheme, port, or path, allowing an unauthenticated caller to induce a token-bearing request to a chosen endpoint on that host. Standard deployments are not exposed to cross-host SSRF, token capture requires attacker-controlled routing on the configured host, and typed deserialization limits returned data to objects shaped like form definitions. The 3.0 release line is fixed in version 3.0.4. The advisory does not identify a fixed 3.1 release.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 18:25 UTC

CWE

CWE-862 - Missing Authorization
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7819 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_CONFIRM
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_MISC
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_MISC
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nl-portal	nl-portal-backend-libraries	Affected: >= 1.1.0, < 3.0.4 Affected: = 3.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55414",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T18:25:48.650492Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T18:26:10.056Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-xm3x-9cfw-jhx4"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nl-portal-backend-libraries",
          "vendor": "nl-portal",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.1.0, \u003c 3.0.4"
            },
            {
              "status": "affected",
              "version": "= 3.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL resolvers are reachable without CommonGroundAuthentication and forward a caller-influenced URL through ObjectenApiService.getObjectByUrl to ObjectsApiClient.getObjectByUrl, which attaches the privileged Objecten-API token. The host-equality check restricts requests to the configured Objecten-API host but does not constrain the scheme, port, or path, allowing an unauthenticated caller to induce a token-bearing request to a chosen endpoint on that host. Standard deployments are not exposed to cross-host SSRF, token capture requires attacker-controlled routing on the configured host, and typed deserialization limits returned data to objects shaped like form definitions. The 3.0 release line is fixed in version 3.0.4. The advisory does not identify a fixed 3.1 release."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T17:33:04.629Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-xm3x-9cfw-jhx4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-xm3x-9cfw-jhx4"
        },
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/pull/700",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/pull/700"
        },
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/commit/5ea04ef6445443e22e40a23fbed447e618b70c3f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/commit/5ea04ef6445443e22e40a23fbed447e618b70c3f"
        },
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/releases/tag/3.0.4.RELEASE",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/releases/tag/3.0.4.RELEASE"
        }
      ],
      "source": {
        "advisory": "GHSA-xm3x-9cfw-jhx4",
        "discovery": "UNKNOWN"
      },
      "title": "NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55414",
    "datePublished": "2026-10-15T17:33:04.629Z",
    "dateReserved": "2026-06-16T21:48:43.125Z",
    "dateUpdated": "2026-10-15T18:26:10.056Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54683 (GCVE-0-2026-54683)

Vulnerability from cvelistv5 – Published: 2026-10-15 17:31 – Updated: 2026-10-15 17:31

Title

NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user until 3.0.3 (incomplete fix of CVE-2026-49463)

Summary

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. Prior to 3.0.3, both the getDocumentContent GraphQL query and GET /api/documentapi/{documentapi}/document/{documentId}/content REST route allow any authenticated portal user to retrieve a document without checking ownership of or another authorized relationship to it. A user with a valid login and another person's document identifier can read that document's contents, which may include sensitive personal information. Document identifiers are random and difficult to guess, but they can leak through other channels. This issue is fixed in version 3.0.3.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-285 - Improper Authorization
CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7819 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_CONFIRM
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_MISC
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_MISC
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_MISC
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_MISC
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nl-portal	nl-portal-backend-libraries	Affected: < 3.0.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "nl-portal-backend-libraries",
          "vendor": "nl-portal",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. Prior to 3.0.3, both the getDocumentContent GraphQL query and GET /api/documentapi/{documentapi}/document/{documentId}/content REST route allow any authenticated portal user to retrieve a document without checking ownership of or another authorized relationship to it. A user with a valid login and another person\u0027s document identifier can read that document\u0027s contents, which may include sensitive personal information. Document identifiers are random and difficult to guess, but they can leak through other channels. This issue is fixed in version 3.0.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T17:31:02.449Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-jr45-52cw-69h5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-jr45-52cw-69h5"
        },
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/pull/684",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/pull/684"
        },
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/pull/690",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/pull/690"
        },
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/commit/6e738a876ff9f581991b5b070706100b5516e183",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/commit/6e738a876ff9f581991b5b070706100b5516e183"
        },
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/commit/e326e6db862f71f76dd46d3b17cbb5fa6f2fba02",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/commit/e326e6db862f71f76dd46d3b17cbb5fa6f2fba02"
        },
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/releases/tag/3.0.3.RELEASE",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/releases/tag/3.0.3.RELEASE"
        }
      ],
      "source": {
        "advisory": "GHSA-jr45-52cw-69h5",
        "discovery": "UNKNOWN"
      },
      "title": "NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user until 3.0.3 (incomplete fix of CVE-2026-49463)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54683",
    "datePublished": "2026-10-15T17:31:02.449Z",
    "dateReserved": "2026-06-15T22:53:58.561Z",
    "dateUpdated": "2026-10-15T17:31:02.449Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-49464 (GCVE-0-2026-49464)

Vulnerability from cvelistv5 – Published: 2026-09-11 20:34 – Updated: 2026-09-15 16:36

Title

NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak

Summary

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:taak` package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the `submitTaakV2` GraphQL mutation, allowing an authenticated user who knows or guesses another user’s task ID to read its form data, overwrite its submitted data, and mark the task as completed. Version 3.0.1 contains a patch. As a workaround, block the `submitTaakV2` mutation at the API gateway or restrict the `/graphql` endpoint to trusted networks

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 16:35 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7819 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
nl-portal	nl-portal-backend-libraries	Affected: >= 1.5.0, < 3.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49464",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T16:35:22.103984Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T16:36:50.488Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nl-portal-backend-libraries",
          "vendor": "nl-portal",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.5.0, \u003c 3.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:taak` package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the `submitTaakV2` GraphQL mutation, allowing an authenticated user who knows or guesses another user\u2019s task ID to read its form data, overwrite its submitted data, and mark the task as completed. Version 3.0.1 contains a patch. As a workaround, block the `submitTaakV2` mutation at the API gateway or restrict the `/graphql` endpoint to trusted networks"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T20:34:14.230Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-6h3c-r723-7fx3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-6h3c-r723-7fx3"
        }
      ],
      "source": {
        "advisory": "GHSA-6h3c-r723-7fx3",
        "discovery": "UNKNOWN"
      },
      "title": "NL Portal: IDOR allows any authenticated user to complete and tamper with another user\u0027s taak"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49464",
    "datePublished": "2026-09-11T20:34:14.230Z",
    "dateReserved": "2026-05-30T04:17:43.094Z",
    "dateUpdated": "2026-09-15T16:36:50.488Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-49462 (GCVE-0-2026-49462)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:53 – Updated: 2026-09-14 16:19

Title

nl.nl-portal:app has GraphiQL UI and GraphQL schema introspection enabled by default

Summary

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. In versions up to and including 3.0.0, deployments using the shipped default configuration exposed two GraphQL developer features without requiring authentication: the GraphiQL playground, an interactive UI for issuing GraphQL queries; and schema introspection, which lets a caller download the full description of every query, mutation, type, and argument the API supports. Anyone who could reach the `/graphiql` endpoint could open the playground in a browser, pull the full schema, and use that to map out the API and craft calls against it. By itself this does not leak user data, but it removes the guesswork from attacking the rest of the API and significantly lowers the bar for finding and exploiting other weaknesses. Version 3.0.1 patches the issue. As a workaround, override the two settings in deployed configuration.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 16:19 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-1188 - Insecure Default Initialization of Resource

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7819 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_CONFIRM
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nl-portal	nl.nl-portal:app	Affected: < 3.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49462",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T16:19:32.111645Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T16:19:42.885Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nl.nl-portal:app",
          "vendor": "nl-portal",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. In versions up to and including 3.0.0, deployments using the shipped default configuration exposed two GraphQL developer features without requiring authentication: the GraphiQL playground, an interactive UI for issuing GraphQL queries; and schema introspection, which lets a caller download the full description of every query, mutation, type, and argument the API supports. Anyone who could reach the `/graphiql` endpoint could open the playground in a browser, pull the full schema, and use that to map out the API and craft calls against it. By itself this does not leak user data, but it removes the guesswork from attacking the rest of the API and significantly lowers the bar for finding and exploiting other weaknesses. Version 3.0.1 patches the issue. As a workaround, override the two settings in deployed configuration."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1188",
              "description": "CWE-1188: Insecure Default Initialization of Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T19:53:04.298Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-9m9w-2vqr-m384",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-9m9w-2vqr-m384"
        },
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/commit/0d2af7665a737e91565352bd4e6124cacaa853b7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/commit/0d2af7665a737e91565352bd4e6124cacaa853b7"
        }
      ],
      "source": {
        "advisory": "GHSA-9m9w-2vqr-m384",
        "discovery": "UNKNOWN"
      },
      "title": "nl.nl-portal:app has GraphiQL UI and GraphQL schema introspection enabled by default"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49462",
    "datePublished": "2026-09-11T19:53:04.298Z",
    "dateReserved": "2026-05-30T04:17:43.094Z",
    "dateUpdated": "2026-09-14T16:19:42.885Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-49463 (GCVE-0-2026-49463)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:29 – Updated: 2026-09-11 19:51

Title

NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries

Summary

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:documenten-api` package through version 3.0.0 and the `nl.nl-portal:besluiten` package from version 1.5.0 through 3.0.0 lack per-user authorization in GraphQL resolvers, allowing an authenticated user to access other users’ document contents, decisions, audit trails, and decision attachments. Version 3.0.1 contains a patch. As a workaround, block the affected document-content and decision-related GraphQL operations at the API gateway or block their GraphQL types entirely.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-11 19:51 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-285 - Improper Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7819 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/nl-portal/nl-portal-backend-li…	x_refsource_CONFIRM

Impacted products

2 products

Vendor	Product	Version
nl-portal	nl.nl-portal:besluiten	Affected: >= 1.5.0, < 3.0.1
nl-portal	nl.nl-portal:documenten-api	Affected: < 3.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49463",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T19:51:06.683901Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T19:51:13.582Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nl.nl-portal:besluiten",
          "vendor": "nl-portal",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.5.0, \u003c 3.0.1"
            }
          ]
        },
        {
          "product": "nl.nl-portal:documenten-api",
          "vendor": "nl-portal",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:documenten-api` package through version 3.0.0 and the `nl.nl-portal:besluiten` package from version 1.5.0 through 3.0.0 lack per-user authorization in GraphQL resolvers, allowing an authenticated user to access other users\u2019 document contents, decisions, audit trails, and decision attachments. Version 3.0.1 contains a patch. As a workaround, block the affected document-content and decision-related GraphQL operations at the API gateway or block their GraphQL types entirely."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T19:51:33.853Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-qpm9-h556-mwxm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-qpm9-h556-mwxm"
        }
      ],
      "source": {
        "advisory": "GHSA-qpm9-h556-mwxm",
        "discovery": "UNKNOWN"
      },
      "title": "NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49463",
    "datePublished": "2026-09-11T19:29:56.465Z",
    "dateReserved": "2026-05-30T04:17:43.094Z",
    "dateUpdated": "2026-09-11T19:51:33.853Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

10 vulnerabilities by nl-portal

CVE-2026-55414 (GCVE-0-2026-55414)

CVE-2026-54683 (GCVE-0-2026-54683)

CVE-2026-49464 (GCVE-0-2026-49464)

CVE-2026-49463 (GCVE-0-2026-49463)

CVE-2026-49462 (GCVE-0-2026-49462)

CVE-2026-55414 (GCVE-0-2026-55414)

CVE-2026-54683 (GCVE-0-2026-54683)

CVE-2026-49464 (GCVE-0-2026-49464)

CVE-2026-49462 (GCVE-0-2026-49462)

CVE-2026-49463 (GCVE-0-2026-49463)