CVE-2026-54683
Received Received - Intake

Information Disclosure in NL Portal Backend Libraries

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. Prior to 3.0.3, both the getDocumentContent GraphQL query and GET /api/documentapi/{documentapi}/document/{documentId}/content REST route allow any authenticated portal user to retrieve a document without checking ownership of or another authorized relationship to it. A user with a valid login and another person's document identifier can read that document's contents, which may include sensitive personal information. Document identifiers are random and difficult to guess, but they can leak through other channels. This issue is fixed in version 3.0.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-16
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-54683
EUVD
EUVD-2026-102225

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nl-portal nl-portal-backend-libraries < 3.0.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the nl-portal backend libraries used in Dutch government portals. Before version 3.0.3, authenticated users could access any document by its ID without verifying ownership or authorization. This allowed unauthorized reading of sensitive personal information through GraphQL queries or REST endpoints.

Detection Guidance

Check for unauthorized access to sensitive documents via the vulnerable REST endpoint GET /api/documentapi/{documentapi}/document/{documentId}/content or GraphQL query getDocumentContent. Monitor logs for requests to these paths without proper authorization checks. Ensure your system is running version 3.0.3 or later of nl-portal-backend-libraries.

Impact Analysis

If you are a user of Dutch government portals, an attacker with a valid login could access your documents or others' documents by guessing document IDs. This could expose sensitive personal data such as citizen or business information stored in these documents.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and insufficient protection measures. It may also breach HIPAA if protected health information was exposed. Organizations using affected versions risk non-compliance with data protection regulations.

Mitigation Strategies

Upgrade to version 3.0.3 or later of nl-portal-backend-libraries. If immediate upgrade is not possible, block the vulnerable REST endpoint and GraphQL query at the gateway or reverse proxy level. Ensure all document access endpoints enforce ownership and authorization checks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54683. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart