{"id":"CVE-2026-49463","title":"NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations","summary":"NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:documenten-api` package through version 3.0.0 and the `n…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-200","CWE-285"],"vendor":"nl-portal","product":"nl.nl-portal:besluiten","affected":["nl.nl-portal:besluiten >= 1.5.0, < 3.0.1","nl.nl-portal:documenten-api < 3.0.1"],"patched":["nl.nl-portal:documenten-api 3.0.1","nl.nl-portal:besluiten 3.0.1"],"published":"2026-09-11","updated":"2026-09-30","sourceUpdated":"2026-09-30T19:57:08.043","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49463","references":[{"url":"https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-qpm9-h556-mwxm","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-qpm9-h556-mwxm"}],"tags":["nvd","cve.org","ghsa","maven"],"epss":0.0034,"epssPercentile":0.27351,"aliases":["GHSA-qpm9-h556-mwxm"],"ecosystem":"maven","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-11T19:51:06.683901Z"},"ingestedAt":"2026-07-08T21:47:02.935Z","slug":"CVE-2026-49463","body":"## Overview\n\nNL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:documenten-api` package through version 3.0.0 and the `nl.nl-portal:besluiten` package from version 1.5.0 through 3.0.0 lack per-user authorization in GraphQL resolvers, allowing an authenticated user to access other users’ document contents, decisions, audit trails, and decision attachments. Version 3.0.1 contains a patch. As a workaround, block the affected document-content and decision-related GraphQL operations at the API gateway or block their GraphQL types entirely.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-49463)\n\nAffected packages:\n\n- `nl.nl-portal:documenten-api <= 3.0.0`\n- `nl.nl-portal:besluiten >= 1.5.0, <= 3.0.0`\n\nPatched in:\n\n- `nl.nl-portal:documenten-api 3.0.1`\n- `nl.nl-portal:besluiten 3.0.1`\n\nSource: https://github.com/advisories/GHSA-qpm9-h556-mwxm","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}