Improper Access Control in NL Portal Backend Libraries Affecting Dutch Government Portals

CVE-2026-54683

What is CVE-2026-54683?

The NL Portal Backend Libraries, crucial for numerous Dutch government portals, faced an access control vulnerability allowing authenticated users to access sensitive documents without verifying ownership. Prior to version 3.0.3, both the GraphQL getDocumentContent query and the GET /api/documentapi/{documentapi}/document/{documentId}/content endpoint could be exploited, exposing potentially sensitive personal information based on shared document identifiers. Though these identifiers are not easily guessable, there exists a risk of leakage through various channels. The issue was resolved in version 3.0.3.

References