# CVE-2026-49464: NL Portal IDOR in task submission component

Source: https://junglewise.ai/threats/cve-2026-49464-nl-portal-idor-in-task-submission-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-49464 · Severity: high · CVSS 8.1 · Published 2026-09-11

NL Portal is a platform used by citizens to interact with government services and manage tasks. A security flaw allowed any logged-in user to view, modify, or complete tasks belonging to other citizens by guessing a task ID. This could lead to the exposure of sensitive personal data and the unauthorized submission of official forms.

Technologies: [NL Portal Backend Libraries](https://junglewise.ai/threats/technologies/nl-portal-backend-libraries). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [NL Portal](https://junglewise.ai/threats/vendors/nl-portal).

## Quick answers

**Is CVE-2026-49464 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49464 being exploited in the wild.

**How severe is CVE-2026-49464?** High severity, with a CVSS score of 8.1, published 11 September 2026.

**Which products and versions are affected?** nl.nl-portal:taak (Maven) >= 1.5.0, <= 3.0.0, ECOSYSTEM:introduced=1.5.0,fixed=3.0.1; NL Portal Backend Libraries 1.5.0 - 3.0.0; NL Portal Taak 1.5.0 - 3.0.0.

**Is there a fix for CVE-2026-49464?** Yes. nl.nl-portal:taak (Maven): upgrade to 3.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49464 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-49464?** Check whether you run nl.nl-portal:taak (Maven), NL Portal Backend Libraries or NL Portal Taak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nl.nl-portal:taak (Maven): upgrade to 3.0.1 or later

  ```sh
  # set nl.nl-portal:taak to 3.0.1 in your pom.xml or build.gradle
  ```


## Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the Taak V2 implementation of NL Portal. The GraphQL resolver 'submitTaakV2' in 'TaakService' fetched task objects by UUID and processed state transitions without verifying if the authenticated user was the legitimate owner of the task. An attacker with a valid OAuth token could exploit this by providing a victim's task ID to the endpoint, allowing them to read existing form data, overwrite submitted data, and mark tasks as completed. The issue is resolved in version 3.0.1 by implementing an authorization check that validates the task's identification against the authenticated principal.

## Affected products

- NL Portal nl-portal-backend-libraries 1.5.0 - 3.0.0
- NL Portal taak 1.5.0 - 3.0.0

## Identifiers

- CVE-2026-49464
- GHSA-6h3c-r723-7fx3

## Timeline

- 2024-06-04: other: Vulnerable code introduced in commit bb1c1ecf
- 2026-05: disclosed: Discovered during penetration testing engagement
- 2026-06-03: advisory: Initial GitHub Advisory publication
- 2026-07-08: patched: Advisory updated and finalized with patch information

## References

- [https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-6h3c-r723-7fx3](https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-6h3c-r723-7fx3)
- [https://api.github.com/repos/nl-portal/nl-portal-backend-libraries/security-advisories/GHSA-6h3c-r723-7fx3](https://api.github.com/repos/nl-portal/nl-portal-backend-libraries/security-advisories/GHSA-6h3c-r723-7fx3)

## Related threats

- [NL Portal Backend Libraries SSRF in form resolver](https://junglewise.ai/threats/cve-2026-55414-nl-portal-backend-libraries-ssrf-in-form-resolver)