CVE-2026-49464

Received Received - Intake

Authentication Bypass in NL Portal Backend Libraries

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: GitHub, Inc.

Description

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:taak` package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the `submitTaakV2` GraphQL mutation, allowing an authenticated user who knows or guesses another user’s task ID to read its form data, overwrite its submitted data, and mark the task as completed. Version 3.0.1 contains a patch. As a workaround, block the `submitTaakV2` mutation at the API gateway or restrict the `/graphql` endpoint to trusted networks

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-49464

Affected Vendors & Products

Vendor	Product	Version / Range
nl.nl-portal	taak	From 1.5.0 (inc) to 3.0.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

The nl.nl-portal:taak package versions 1.5.0 through 3.0.0 has an authorization flaw in the submitTaakV2 GraphQL mutation. It fails to verify if a user owns a task before allowing operations like reading form data, overwriting submissions, or marking tasks as completed. This means an authenticated attacker who guesses or knows another user's task ID can manipulate that task.

Detection Guidance

Check GraphQL API logs for unauthorized submitTaakV2 mutation requests. Monitor task ID access patterns and verify user ownership validation in the nl.nl-portal:taak package versions 1.5.0 through 3.0.0.

Impact Analysis

If you use this package, an attacker could access sensitive form data of other users, alter their submissions, or falsely complete tasks on their behalf. This could lead to data breaches, incorrect records, or unauthorized actions in government portals.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without consent and HIPAA by compromising protected health information if task forms contain such data. It undermines data integrity and confidentiality requirements in these regulations.

Mitigation Strategies

Upgrade nl.nl-portal:taak to version 3.0.1 or later. Block the submitTaakV2 mutation at the API gateway or restrict /graphql endpoint access to trusted networks.

Hi! I’m here to help you understand CVE-2026-49464. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70