# CVE-2026-54683: NL Portal Backend Libraries improper authorization in documenten-api

Source: https://junglewise.ai/threats/cve-2026-54683-nl-portal-backend-libraries-improper-authorization-in-documenten  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-06-18  
License: CC BY 4.0 with a link back

CVE-2026-54683 · Severity: medium · CVSS 6.5 · Published 2026-10-15

NL Portal Backend Libraries, used to build citizen and business portals, contained a flaw where any logged-in user could download documents belonging to other users. By knowing or guessing a document's unique identifier, an unauthorized person could access sensitive personal information or business records. This issue persisted despite a previous attempt to fix it and has now been fully resolved by removing the insecure access points.

Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [NL Portal](https://junglewise.ai/threats/vendors/nl-portal).

## Quick answers

**Is CVE-2026-54683 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54683 being exploited in the wild.

**How severe is CVE-2026-54683?** Medium severity, with a CVSS score of 6.5, published 15 October 2026.

**Which products and versions are affected?** nl.nl-portal:documenten-api (Maven) < 3.0.3, ECOSYSTEM:introduced=0,fixed=3.0.3.

**Is there a fix for CVE-2026-54683?** Yes. nl.nl-portal:documenten-api (Maven): upgrade to 3.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54683 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54683?** Check whether you run nl.nl-portal:documenten-api (Maven) or NL Portal Documenten API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nl.nl-portal:documenten-api (Maven): upgrade to 3.0.3 or later

  ```sh
  # set nl.nl-portal:documenten-api to 3.0.3 in your pom.xml or build.gradle
  ```


## Technical details

An improper authorization vulnerability (CWE-285/CWE-639) exists in the nl.nl-portal:documenten-api module. While a previous fix (CVE-2026-49463) addressed metadata access, the document content remained accessible via the 'getDocumentContent' GraphQL query and a specific REST endpoint (/api/documentapi/{documentapi}/document/{documentId}/content). These endpoints verified that a user was authenticated but failed to verify if the user had a legitimate relationship (ownership or case-role) to the requested document. Attackers with valid credentials could bypass intended access controls by providing a target document's UUID. The vulnerability was fully remediated in version 3.0.3 by removing the insecure endpoints in favor of case-scoped and message-scoped alternatives.

## Affected products

- NL Portal (nl.nl-portal) documenten-api < 3.0.3

## Identifiers

- CVE-2026-54683
- GHSA-jr45-52cw-69h5

## Timeline

- 2026-06-08: patched: Fix commits merged into release candidate 3.0.3
- 2026-06-17: disclosed: Initial advisory publication
- 2026-06-18: advisory: Advisory updated and published to GitHub Database

## References

- [https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-jr45-52cw-69h5](https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-jr45-52cw-69h5)
- [https://github.com/nl-portal/nl-portal-backend-libraries/pull/690](https://github.com/nl-portal/nl-portal-backend-libraries/pull/690)
- [https://github.com/nl-portal/nl-portal-backend-libraries/commit/6e738a876ff9f581991b5b070706100b5516e183](https://github.com/nl-portal/nl-portal-backend-libraries/commit/6e738a876ff9f581991b5b070706100b5516e183)
- [https://github.com/nl-portal/nl-portal-backend-libraries/commit/e326e6db862f71f76dd46d3b17cbb5fa6f2fba02](https://github.com/nl-portal/nl-portal-backend-libraries/commit/e326e6db862f71f76dd46d3b17cbb5fa6f2fba02)
- [https://api.github.com/repos/nl-portal/nl-portal-backend-libraries/security-advisories/GHSA-jr45-52cw-69h5](https://api.github.com/repos/nl-portal/nl-portal-backend-libraries/security-advisories/GHSA-jr45-52cw-69h5)

## Related threats

- [NL Portal backend libraries improper authorization in GraphQL resolvers](https://junglewise.ai/threats/cve-2026-49463-nl-portal-backend-libraries-improper-authorization-in-graphql)