---
id: CVE-2026-54683
title: >-
  NL Portal Backend Libraries provide backend components for Dutch government
  portals that interact with residents, customers, suppliers, and partner
  organizations
summary: >-
  NL Portal Backend Libraries provide backend components for Dutch government
  portals that interact with residents, customers, suppliers, and partner
  organizations. Prior to 3.0.3, both the getDocumentContent GraphQL query and
  GET /api/doc…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-285
  - CWE-639
vendor: nl-portal
product: nl-portal-backend-libraries
affected:
  - nl-portal-backend-libraries < 3.0.3
patched:
  - 'nl.nl-portal:documenten-api 3.0.3'
published: '2026-10-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T20:04:29.760'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54683'
references:
  - url: >-
      https://github.com/nl-portal/nl-portal-backend-libraries/commit/6e738a876ff9f581991b5b070706100b5516e183
    label: security-advisories@github.com
  - url: >-
      https://github.com/nl-portal/nl-portal-backend-libraries/commit/e326e6db862f71f76dd46d3b17cbb5fa6f2fba02
    label: security-advisories@github.com
  - url: 'https://github.com/nl-portal/nl-portal-backend-libraries/pull/684'
    label: security-advisories@github.com
  - url: 'https://github.com/nl-portal/nl-portal-backend-libraries/pull/690'
    label: security-advisories@github.com
  - url: >-
      https://github.com/nl-portal/nl-portal-backend-libraries/releases/tag/3.0.3.RELEASE
    label: security-advisories@github.com
  - url: >-
      https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-jr45-52cw-69h5
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-jr45-52cw-69h5'
tags:
  - nvd
  - cve.org
  - ghsa
  - maven
  - exploit-available
epss: 0.00423
epssPercentile: 0.3658
ecosystem: maven
ingestedAt: '2026-06-19T03:39:00.795Z'
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-28T20:06:33.619126Z'
---

## Overview

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. Prior to 3.0.3, both the getDocumentContent GraphQL query and GET /api/documentapi/{documentapi}/document/{documentId}/content REST route allow any authenticated portal user to retrieve a document without checking ownership of or another authorized relationship to it. A user with a valid login and another person's document identifier can read that document's contents, which may include sensitive personal information. Document identifiers are random and difficult to guess, but they can leak through other channels. This issue is fixed in version 3.0.3.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54683)

Affected packages:

- `nl.nl-portal:documenten-api < 3.0.3`

Patched in:

- `nl.nl-portal:documenten-api 3.0.3`

Source: https://github.com/advisories/GHSA-jr45-52cw-69h5