CVE-2026-54683: NL Portal Backend Libraries improper authorization in documenten-api

CVE-2026-54683 · Severity: medium · CVSS 6.5 · Published 2026-10-15

NL Portal Backend Libraries, used to build citizen and business portals, contained a flaw where any logged-in user could download documents belonging to other users. By knowing or guessing a document's unique identifier, an unauthorized person could access sensitive personal information or business records. This issue persisted despite a previous attempt to fix it and has now been fully resolved by removing the insecure access points.

Vendors: Maven, NL Portal.

Quick answers

Is CVE-2026-54683 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54683 being exploited in the wild.
How severe is CVE-2026-54683?
Medium severity, with a CVSS score of 6.5, published 15 October 2026.
Which products and versions are affected?
nl.nl-portal:documenten-api (Maven) < 3.0.3, ECOSYSTEM:introduced=0,fixed=3.0.3.
Is there a fix for CVE-2026-54683?
Yes. nl.nl-portal:documenten-api (Maven): upgrade to 3.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54683 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54683?
Check whether you run nl.nl-portal:documenten-api (Maven) or NL Portal Documenten API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nl.nl-portal:documenten-api (Maven): upgrade to 3.0.3 or later
    # set nl.nl-portal:documenten-api to 3.0.3 in your pom.xml or build.gradle

Technical details

An improper authorization vulnerability (CWE-285/CWE-639) exists in the nl.nl-portal:documenten-api module. While a previous fix (CVE-2026-49463) addressed metadata access, the document content remained accessible via the 'getDocumentContent' GraphQL query and a specific REST endpoint (/api/documentapi/{documentapi}/document/{documentId}/content). These endpoints verified that a user was authenticated but failed to verify if the user had a legitimate relationship (ownership or case-role) to the requested document. Attackers with valid credentials could bypass intended access controls by providing a target document's UUID. The vulnerability was fully remediated in version 3.0.3 by removing the insecure endpoints in favor of case-scoped and message-scoped alternatives.

Affected products

  • NL Portal (nl.nl-portal) documenten-api < 3.0.3

Identifiers

  • CVE-2026-54683
  • GHSA-jr45-52cw-69h5

Timeline

  • 2026-06-08: patched: Fix commits merged into release candidate 3.0.3
  • 2026-06-17: disclosed: Initial advisory publication
  • 2026-06-18: advisory: Advisory updated and published to GitHub Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.