CVE-2026-49463: NL Portal backend libraries improper authorization in GraphQL resolvers

CVE-2026-49463 · Severity: medium · CVSS 6.5 · Published 2026-09-11

NL Portal is a backend library used to manage citizen portals and government documents. A security flaw allows any logged-in user to view and download sensitive documents and decision records (such as benefit or permit details) belonging to other users. This could lead to a significant breach of personal data confidentiality across the platform.

Vendors: Maven, NL Portal.

Quick answers

Is CVE-2026-49463 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49463 being exploited in the wild.
How severe is CVE-2026-49463?
Medium severity, with a CVSS score of 6.5, published 11 September 2026.
Which products and versions are affected?
nl.nl-portal:besluiten (Maven) >= 1.5.0, <= 3.0.0, ECOSYSTEM:introduced=1.5.0,fixed=3.0.1; nl.nl-portal:documenten-api (Maven) <= 3.0.0, ECOSYSTEM:introduced=0,fixed=3.0.1; NL Portal Nl-Portal-Backend-Libraries (Besluiten) >= 1.5.0, <= 3.0.0; NL Portal Nl-Portal-Backend-Libraries (Documenten-Api) <= 3.0.0.
Is there a fix for CVE-2026-49463?
Yes. nl.nl-portal:besluiten (Maven): upgrade to 3.0.1 or later; nl.nl-portal:documenten-api (Maven): upgrade to 3.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49463 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-49463?
Check whether you run nl.nl-portal:besluiten (Maven), nl.nl-portal:documenten-api (Maven), NL Portal Nl-Portal-Backend-Libraries (Besluiten) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nl.nl-portal:besluiten (Maven): upgrade to 3.0.1 or later
    # set nl.nl-portal:besluiten to 3.0.1 in your pom.xml or build.gradle
  • nl.nl-portal:documenten-api (Maven): upgrade to 3.0.1 or later
    # set nl.nl-portal:documenten-api to 3.0.1 in your pom.xml or build.gradle

Technical details

The vulnerability stems from missing 'CommonGroundAuthentication' parameters in GraphQL resolver method signatures within the 'documenten-api' and 'besluiten' modules. Because the authenticated principal was not bound to the resolver, the framework did not enforce user-scoped authorization checks. An attacker with a valid login can use the 'getBesluiten' query to enumerate decision records across the user base and then use discovered IDs to exfiltrate raw document content via 'getDocumentContent'. The issue is resolved in version 3.0.1 by adding the required authentication parameters to the document resolver and removing the vulnerable 'besluiten' module entirely.

Affected products

  • NL Portal nl-portal-backend-libraries (besluiten) >= 1.5.0, <= 3.0.0
  • NL Portal nl-portal-backend-libraries (documenten-api) <= 3.0.0

Identifiers

  • CVE-2026-49463
  • GHSA-qpm9-h556-mwxm

Timeline

  • 2026-05: disclosed: Discovered during penetration testing engagement
  • 2026-06-03: advisory: Initial internal advisory publication
  • 2026-07-08: patched: Public disclosure and patch availability confirmed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.