CVE-2025-62362: Burgerportaal Information Disclosure Flaw

CVE-2025-62362 Overview

CVE-2025-62362 is an information disclosure vulnerability in gpp-burgerportaal, a Dutch government citizen portal application used to publish public content. The application exposes the names and email addresses of employees who publish content within network responses. Anyone browsing the portal can retrieve this data by inspecting the browser developer tools network tab. The exposure falls under [CWE-359: Exposure of Private Personal Information to an Unauthorized Actor]. Affected releases are all versions prior to 2.0.3, 3.0.2, and 4.0.1. Attackers can harvest disclosed identifiers for targeted phishing, social engineering, or unwanted contact against government employees.

Critical Impact
Unauthenticated network-based access to employee names and email addresses of Dutch government content publishers, enabling reconnaissance for targeted attacks.

Affected Products

gpp-burgerportaal versions prior to 2.0.3 (2.x branch)
gpp-burgerportaal versions prior to 3.0.2 (3.x branch)
gpp-burgerportaal versions prior to 4.0.1 (4.x branch)

Discovery Timeline

2025-10-13 - CVE-2025-62362 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62362

Vulnerability Analysis

The gpp-burgerportaal application returns publication metadata to unauthenticated clients through its backend API. The response payloads include the full name and email address of the internal employee who authored or published each content item. Because the fields are transmitted over the wire and only hidden from the rendered user interface, any visitor can retrieve them by opening the browser developer tools and inspecting the network tab. No authentication, elevated privileges, or user interaction is required to observe the responses. The disclosure applies to every published record served through the affected endpoints, allowing bulk enumeration of employee identities.

Root Cause

The root cause is over-inclusion of personally identifiable information (PII) in API response models. The backend serializes internal author metadata alongside publicly relevant fields instead of stripping or masking employee identifiers before returning results to citizen-facing clients. This is a classic server-side filtering failure where client-side rendering, rather than server-side data minimization, is relied upon to hide sensitive attributes.

Attack Vector

An unauthenticated remote attacker sends standard HTTPS requests to the portal's public content endpoints and parses the JSON responses. The attacker enumerates published items and extracts name and email fields for each associated employee. The harvested list can then feed targeted spear-phishing campaigns, credential-stuffing against government single sign-on, or direct social engineering against named staff. No exploit code is required because the disclosure occurs in normal application traffic. See the GitHub Security Advisory GHSA-pgg6-2865-2788 for the maintainer's technical description.

Detection Methods for CVE-2025-62362

Indicators of Compromise

HTTP responses from the portal containing name or email fields tied to internal employee accounts rather than citizen-facing values.
Large volumes of sequential or scripted GET requests to public content APIs from a single client, consistent with response scraping.
Access-log spikes from non-browser user agents or headless clients targeting publication endpoints.

Detection Strategies

Inspect JSON responses from gpp-burgerportaal endpoints and flag payloads that include employee email attributes.
Correlate outbound response body sizes against baseline for public content endpoints to identify anomalous data volumes.
Review web application firewall (WAF) or reverse proxy logs for repeated enumeration patterns against publication routes.

Monitoring Recommendations

Enable full request and response logging on the portal's API gateway for public endpoints during the remediation window.
Alert on any client that fetches more than a normal citizen-session count of publications within a short interval.
Monitor employee mailboxes for a rise in targeted phishing referencing publication activity or internal role context.

How to Mitigate CVE-2025-62362

Immediate Actions Required

Upgrade gpp-burgerportaal to version 2.0.3, 3.0.2, or 4.0.1 depending on the deployed branch.
Rotate or increase phishing-awareness training for employees whose names and email addresses were exposed before the patch.
Review historical access logs for suspicious enumeration of publication endpoints and preserve them for incident response.

Patch Information

The maintainers of the GPP-Woo project patched the issue in gpp-burgerportaal versions 2.0.3, 3.0.2, and 4.0.1. The fix removes internal employee identifiers from API response payloads served to unauthenticated clients. Deployment details are documented in the GitHub Security Advisory GHSA-pgg6-2865-2788.

Workarounds

No official workaround exists according to the vendor advisory; upgrading to a patched version is the only supported remediation.
As an interim compensating control, place a reverse proxy or API gateway in front of the portal to strip name and email fields from JSON responses on affected routes until the upgrade is applied.

bash

# Example: strip employee PII fields at an NGINX + njs reverse proxy until patched
# /etc/nginx/pii-filter.js
function filter(r) {
    r.subrequest('/upstream' + r.uri, { method: r.method }, function(res) {
        try {
            var data = JSON.parse(res.responseBody);
            (Array.isArray(data) ? data : [data]).forEach(function(item) {
                delete item.name;
                delete item.email;
            });
            r.headersOut['Content-Type'] = 'application/json';
            r.return(res.status, JSON.stringify(data));
        } catch (e) {
            r.return(res.status, res.responseBody);
        }
    });
}