---
id: CVE-2026-49464
title: >-
  NL Portal Backend Libraries provide backend components for Dutch government
  portals that interact with residents, customers, suppliers, and partner
  organizations
summary: >-
  NL Portal Backend Libraries provide backend components for Dutch government
  portals that interact with residents, customers, suppliers, and partner
  organizations. The `nl.nl-portal:taak` package from version 1.5.0 through
  3.0.0 fails to …
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-639
vendor: nl-portal
product: nl-portal-backend-libraries
affected:
  - 'nl-portal-backend-libraries >= 1.5.0, < 3.0.1'
patched:
  - 'nl.nl-portal:taak 3.0.1'
published: '2026-09-11'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T17:17:16.253'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49464'
references:
  - url: >-
      https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-6h3c-r723-7fx3
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-6h3c-r723-7fx3'
tags:
  - nvd
  - cve.org
  - ghsa
  - maven
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-15T16:35:22.103984Z'
epss: 0.0035
epssPercentile: 0.25826
aliases:
  - GHSA-6h3c-r723-7fx3
ecosystem: maven
ingestedAt: '2026-07-08T21:47:02.931Z'
---

## Overview

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:taak` package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the `submitTaakV2` GraphQL mutation, allowing an authenticated user who knows or guesses another user’s task ID to read its form data, overwrite its submitted data, and mark the task as completed. Version 3.0.1 contains a patch. As a workaround, block the `submitTaakV2` mutation at the API gateway or restrict the `/graphql` endpoint to trusted networks

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-49464)

Affected packages:

- `nl.nl-portal:taak >= 1.5.0, <= 3.0.0`

Patched in:

- `nl.nl-portal:taak 3.0.1`

Source: https://github.com/advisories/GHSA-6h3c-r723-7fx3