Authorization Vulnerability in NL Portal Backend Libraries for Dutch Government Portals

CVE-2026-49463

What is CVE-2026-49463?

The NL Portal Backend Libraries, utilized by Dutch government portals, exhibit a significant authorization vulnerability. Specifically, the nl.nl-portal:documenten-api package up to version 3.0.0 and the nl.nl-portal:besluiten package from version 1.5.0 through 3.0.0 lack sufficient per-user authorization in their GraphQL resolvers. This deficiency enables an authenticated user to access confidential document contents, decisions, audit trails, and related attachments that belong to other users. Users are encouraged to upgrade to version 3.0.1, which includes a necessary patch. In the interim, it is advisable to restrict access to the affected GraphQL operations at the API gateway or entirely block their GraphQL types.

References