CVE-2026-49464: NL Portal Backend Auth Bypass Vulnerability

CVE-2026-49464 Overview

CVE-2026-49464 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in the NL Portal Backend Libraries, which provide backend components for Dutch government portals serving residents, customers, suppliers, and partner organizations. The nl.nl-portal:taak package fails to verify task ownership when processing the submitTaakV2 GraphQL mutation. An authenticated user who knows or guesses another user's task identifier can read the associated form data, overwrite the submitted data, and mark the task as completed. Affected versions span 1.5.0 through 3.0.0, with version 3.0.1 containing the patch.

Critical Impact
Any authenticated portal user can access and manipulate other users' government form submissions by supplying a valid task ID to the submitTaakV2 mutation.

Affected Products

nl.nl-portal:taak package versions 1.5.0 through 3.0.0
NL Portal Backend Libraries deployments exposing the /graphql endpoint
Dutch government portals built on the NL Portal framework

Discovery Timeline

2026-09-11 - CVE-2026-49464 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-49464

Vulnerability Analysis

The vulnerability resides in the GraphQL resolver backing the submitTaakV2 mutation within the nl.nl-portal:taak package. The resolver processes task submissions using only a task identifier supplied by the caller. It does not compare the authenticated user's identity against the owner recorded on the target task.

Because the mutation returns the task's form data as part of its response, exploitation yields both a read and write primitive against arbitrary tasks. An attacker can enumerate identifiers or reuse leaked ones to retrieve sensitive citizen-submitted content, alter that content, and set the task state to completed. In a government portal context, this affects the integrity of official form submissions and the confidentiality of resident data.

Root Cause

The root cause is missing authorization on a per-object basis, matching the definition of [CWE-639]: Authorization Bypass Through User-Controlled Key. The submitTaakV2 resolver authenticates the session but does not perform an ownership check binding the requested task to the current principal.

Attack Vector

Exploitation requires a valid authenticated session on the portal. The attacker sends a submitTaakV2 GraphQL mutation to the /graphql endpoint with a target task ID belonging to another user. The server returns the task's form data and accepts the attacker-supplied payload as the new submission, marking the task as completed. No user interaction from the victim is required.

See the GitHub Security Advisory for the vendor description of the resolver behavior.

Detection Methods for CVE-2026-49464

Indicators of Compromise

GraphQL requests to /graphql containing the submitTaakV2 operation where the acting user does not match the task owner recorded in the backing datastore.
Task records completed by a session whose subject identifier differs from the task's assigned owner.
Spikes in submitTaakV2 calls from a single authenticated principal referencing many distinct task IDs.

Detection Strategies

Parse application and reverse-proxy logs for GraphQL operation names and cross-reference the authenticated subject with the target task owner.
Instrument the resolver to emit an audit event whenever submitTaakV2 mutates a task, including the caller ID and task owner ID for downstream correlation.
Alert on sequential or high-entropy task ID access patterns indicative of enumeration.

Monitoring Recommendations

Forward portal, API gateway, and GraphQL server logs to a centralized analytics platform and retain them for post-incident review.
Track the rate of submitTaakV2 mutations per user and baseline normal behavior to surface anomalies.
Review historical task completion events for owner and submitter mismatches following upgrade to 3.0.1.

How to Mitigate CVE-2026-49464

Immediate Actions Required

Upgrade the nl.nl-portal:taak package to version 3.0.1 or later across all environments.
Audit task submission records for the affected version range to identify tasks completed by a non-owner.
Rotate or invalidate portal sessions if evidence of enumeration is observed.

Patch Information

The maintainers released the fix in nl.nl-portal:taak version 3.0.1, which adds an ownership check to the submitTaakV2 resolver. Details are published in the NL Portal GitHub Security Advisory GHSA-6h3c-r723-7fx3.

Workarounds

Block the submitTaakV2 mutation at the API gateway until the upgrade is deployed.
Restrict the /graphql endpoint to trusted networks or authenticated internal clients.
Add a gateway-level policy that inspects GraphQL operation names and denies submitTaakV2 requests originating from untrusted networks.

bash

# Example API gateway rule to block the vulnerable mutation
# (adapt to your gateway's policy language)
if request.path == "/graphql" and request.body contains "submitTaakV2":
    deny 403 "submitTaakV2 blocked pending CVE-2026-49464 patch"