Executive brief
NL Portal Backend Libraries, used to build citizen and business portals, contained a flaw where any logged-in user could download documents belonging to other users. By knowing or guessing a document's unique identifier, an unauthorized person could access sensitive personal information or business records. This issue persisted despite a previous attempt to fix it and has now been fully resolved by removing the insecure access points.
Technical details
An improper authorization vulnerability (CWE-285/CWE-639) exists in the nl.nl-portal:documenten-api module. While a previous fix (CVE-2026-49463) addressed metadata access, the document content remained accessible via the 'getDocumentContent' GraphQL query and a specific REST endpoint (/api/documentapi/{documentapi}/document/{documentId}/content). These endpoints verified that a user was authenticated but failed to verify if the user had a legitimate relationship (ownership or case-role) to the requested document. Attackers with valid credentials could bypass intended access controls by providing a target document's UUID. The vulnerability was fully remediated in version 3.0.3 by removing the insecure endpoints in favor of case-scoped and message-scoped alternatives.
Affected products
- NL Portal (nl.nl-portal) documenten-api < 3.0.3
Timeline
- 2026-06-08: patched: Fix commits merged into release candidate 3.0.3
- 2026-06-17: disclosed: Initial advisory publication
- 2026-06-18: advisory: Advisory updated and published to GitHub Database
References
- https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-jr45-52cw-69h5
- https://github.com/nl-portal/nl-portal-backend-libraries/pull/690
- https://github.com/nl-portal/nl-portal-backend-libraries/commit/6e738a876ff9f581991b5b070706100b5516e183
- https://github.com/nl-portal/nl-portal-backend-libraries/commit/e326e6db862f71f76dd46d3b17cbb5fa6f2fba02
- https://api.github.com/repos/nl-portal/nl-portal-backend-libraries/security-advisories/GHSA-jr45-52cw-69h5