CVE-2026-49463

Deferred Deferred - Pending Action

Information Disclosure in NL Portal Backend Libraries

Publication date: 2026-09-11

Last updated on: 2026-09-30

Assigner: GitHub, Inc.

Description

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:documenten-api` package through version 3.0.0 and the `nl.nl-portal:besluiten` package from version 1.5.0 through 3.0.0 lack per-user authorization in GraphQL resolvers, allowing an authenticated user to access other users’ document contents, decisions, audit trails, and decision attachments. Version 3.0.1 contains a patch. As a workaround, block the affected document-content and decision-related GraphQL operations at the API gateway or block their GraphQL types entirely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-30

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-49463

EUVD

EUVD-2026-76244

Affected Vendors & Products

Vendor	Product	Version / Range
nl.nl-portal	documenten-api	to 3.0.0 (inc)
nl.nl-portal	besluiten	From 1.5.0 (inc) to 3.0.0 (inc)
nl.nl-portal	documenten-api	3.0.0
nl.nl-portal	nl-portal-backend-libraries	to 3.0.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects NL Portal Backend Libraries used by Dutch government portals. It involves missing per-user authorization in GraphQL resolvers for two packages: nl.nl-portal:documenten-api up to version 3.0.0 and nl.nl-portal:besluiten from 1.5.0 to 3.0.0. An authenticated user can access other users' document contents, decisions, audit trails, and attachments due to improper access controls.

Detection Guidance

Check if your system uses the affected nl.nl-portal:documenten-api package versions before 3.0.1 or nl.nl-portal:besluiten package versions between 1.5.0 and 3.0.0. Inspect GraphQL resolver logs for unauthorized access attempts to document contents, decisions, or audit trails.

Impact Analysis

If you are a user of Dutch government portals using these libraries, your sensitive information such as documents, decisions, or audit trails could be accessed by other authenticated users. This could lead to privacy breaches or unauthorized data exposure.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and insufficient access controls. It may also conflict with HIPAA if protected health information is exposed. Organizations must ensure proper authorization to maintain compliance.

Mitigation Strategies

Upgrade to version 3.0.1 or later for both nl.nl-portal:documenten-api and nl.nl-portal:besluiten packages. As a temporary workaround, block affected GraphQL operations or types at the API gateway level.

Hi! I’m here to help you understand CVE-2026-49463. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70