CVE-2026-49463

    Dashboard / Vulnerabilities / CVE-2026-49463

    CVE-2026-49463

    Published: 11 Sept 2026Last Modified: 12 Sept 2026

    Summary: NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries

    Details: NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:documenten-api` package through version 3.0.0 and the `nl.nl-portal:besluiten` package from version 1.5.0 through 3.0.0 lack per-user authorization in GraphQL resolvers, allowing an authenticated user to access other users’ document contents, decisions, audit trails, and decision attachments. Version 3.0.1 contains a patch. As a workaround, block the affected document-content and decision-related GraphQL operations at the API gateway or block their GraphQL types entirely.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49463.json, https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-qpm9-h556-mwxm, https://nvd.nist.gov/vuln/detail/CVE-2026-49463

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -b8a353c4bcf87b44a6ce70e4bd605518fccb518e

    Affected versions

    1.0.8.RELEASE
    1.0.7.RELEASE
    1.0.6.RELEASE
    1.0.5.RELEASE
    1.0.3.RELEASE
    1.0.2.RELEASE
    1.0.1.RELEASE
    1.0.0.RELEASE

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High