CVE-2026-49463 Overview
CVE-2026-49463 is a broken access control vulnerability in the NL Portal Backend Libraries, which provide backend components for Dutch government portals serving residents, customers, suppliers, and partner organizations. The nl.nl-portal:documenten-api package through version 3.0.0 and the nl.nl-portal:besluiten package from version 1.5.0 through 3.0.0 fail to enforce per-user authorization in their GraphQL resolvers. Authenticated users can retrieve other users' document contents, decisions, audit trails, and decision attachments. The maintainers released a patch in version 3.0.1. The weakness is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).
Critical Impact
Any authenticated portal user can read documents, decisions, and audit trails belonging to other residents or organizations, breaking tenant isolation in government-facing services.
Affected Products
- nl.nl-portal:documenten-api through version 3.0.0
- nl.nl-portal:besluiten from version 1.5.0 through 3.0.0
- NL Portal Backend Libraries deployments serving Dutch government portals
Discovery Timeline
- 2026-09-11 - CVE-2026-49463 published to NVD
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-49463
Vulnerability Analysis
The NL Portal Backend Libraries expose document and decision data through a GraphQL API. Resolvers in the documenten-api and besluiten packages authenticate the caller but never verify that the caller owns or is authorized to view the requested resource. An authenticated user can therefore issue GraphQL queries for document content, decisions, audit trails, or decision attachments and receive data belonging to any other user in the system.
The impact is confidentiality-focused. Integrity and availability of the affected records are not directly changed by this flaw. In a Dutch government portal context, exposed records may include correspondence with residents, official decisions issued to organizations, and related evidentiary attachments.
Root Cause
The root cause is missing object-level authorization in GraphQL resolvers. Authentication proves who the caller is, but the resolvers do not check that the caller is the subject of the requested document or decision. This class of flaw is commonly known as Broken Object Level Authorization (BOLA) and maps to [CWE-200].
Attack Vector
Exploitation requires only a valid authenticated session against the portal. An attacker enumerates or guesses document and decision identifiers, then issues GraphQL queries that request the associated content, audit trails, or attachments. Because no per-user check is performed, the resolver returns data for any identifier the attacker supplies. No user interaction from the victim is required, and the attack is executed remotely over the network.
No verified public exploit code is available. Refer to the GitHub Security Advisory for technical details.
Detection Methods for CVE-2026-49463
Indicators of Compromise
- GraphQL queries against document-content or decision-related operations issued by user sessions that reference resource identifiers outside the caller's expected scope.
- Elevated volumes of document, documentContent, besluit, or attachment queries originating from a single authenticated principal.
- Sequential or enumerated identifier patterns in GraphQL variables sent to documenten-api or besluiten resolvers.
Detection Strategies
- Correlate the authenticated user identity in access logs with the owner of each returned document or decision record and alert on mismatches.
- Baseline normal per-user GraphQL query rates and flag statistical outliers accessing document-content or decision operations.
- Enable verbose logging on the affected resolvers to capture the resolved resource owner alongside the caller.
Monitoring Recommendations
- Forward API gateway and portal application logs to a centralized analytics platform to run cross-user access correlation.
- Monitor for HTTP 200 responses to GraphQL queries that follow enumeration patterns in identifier variables.
- Alert on any access to decision attachments where the requesting user is not listed as the decision recipient.
How to Mitigate CVE-2026-49463
Immediate Actions Required
- Upgrade nl.nl-portal:documenten-api and nl.nl-portal:besluiten to version 3.0.1 or later.
- If patching is delayed, block the affected document-content and decision-related GraphQL operations at the API gateway.
- Audit access logs for the affected resolvers to identify prior unauthorized access to other users' records.
- Notify affected data subjects if evidence of unauthorized access is found, as required under Dutch and EU data protection law.
Patch Information
Version 3.0.1 of the NL Portal Backend Libraries contains the fix that enforces per-user authorization in the affected GraphQL resolvers. Details are published in the GitHub Security Advisory GHSA-qpm9-h556-mwxm.
Workarounds
- Block the affected document-content and decision-related GraphQL operations at the API gateway.
- Remove or disable the vulnerable GraphQL types entirely until the upgrade to 3.0.1 is deployed.
- Restrict portal access to trusted authenticated users only and monitor sessions for enumeration behavior.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
