{"id":"CVE-2026-49463","title":"NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries","summary":"NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:documenten-api` package through version 3.0.0 and the `n…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-200","CWE-285"],"vendor":"nl-portal","product":"nl.nl-portal:besluiten","affected":["nl.nl-portal:besluiten >= 1.5.0, < 3.0.1","nl.nl-portal:documenten-api < 3.0.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-11T19:51:06.683901Z"},"published":"2026-09-11","updated":"2026-09-11","sourceUpdated":"2026-09-11T19:51:33.853Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-49463","references":[{"url":"https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-qpm9-h556-mwxm","label":"https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-qpm9-h556-mwxm"},{"url":"https://github.com/advisories/GHSA-qpm9-h556-mwxm"}],"tags":["cve.org","nvd","ghsa","maven"],"epss":0.00315,"epssPercentile":0.24571,"aliases":["GHSA-qpm9-h556-mwxm"],"ecosystem":"maven","patched":["nl.nl-portal:documenten-api 3.0.1","nl.nl-portal:besluiten 3.0.1"],"ingestedAt":"2026-07-08T21:47:02.935Z","slug":"CVE-2026-49463","body":"## Overview\n\nNL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:documenten-api` package through version 3.0.0 and the `nl.nl-portal:besluiten` package from version 1.5.0 through 3.0.0 lack per-user authorization in GraphQL resolvers, allowing an authenticated user to access other users’ document contents, decisions, audit trails, and decision attachments. Version 3.0.1 contains a patch. As a workaround, block the affected document-content and decision-related GraphQL operations at the API gateway or block their GraphQL types entirely.\n\n## Affected\n\n- `nl.nl-portal:besluiten >= 1.5.0, < 3.0.1`\n- `nl.nl-portal:documenten-api < 3.0.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-49463)\n\nAffected packages:\n\n- `nl.nl-portal:documenten-api <= 3.0.0`\n- `nl.nl-portal:besluiten >= 1.5.0, <= 3.0.0`\n\nPatched in:\n\n- `nl.nl-portal:documenten-api 3.0.1`\n- `nl.nl-portal:besluiten 3.0.1`\n\nSource: https://github.com/advisories/GHSA-qpm9-h556-mwxm","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}