CVE-2026-54683: NL Portal Backend Auth Bypass Vulnerability

CVE-2026-54683 Overview

CVE-2026-54683 is a broken access control vulnerability [CWE-285] in NL Portal Backend Libraries, which provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. Versions prior to 3.0.3 allow any authenticated portal user to retrieve any document by identifier, regardless of ownership. Both the getDocumentContent GraphQL query and the GET /api/documentapi/{documentapi}/document/{documentId}/content REST route fail to validate the requester's relationship to the document. The flaw is fixed in version 3.0.3.

Critical Impact

Authenticated users can read arbitrary documents containing sensitive personal information if they obtain or leak a target document identifier.

Affected Products

• NL Portal Backend Libraries versions prior to 3.0.3
• Dutch government portal deployments using the documenten-api component
• Applications exposing the getDocumentContent GraphQL query or the /api/documentapi/{documentapi}/document/{documentId}/content REST endpoint

Discovery Timeline

• 2026-10-15 - CVE-2026-54683 published to NVD
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-54683

Vulnerability Analysis

The NL Portal Backend Libraries expose two code paths for document retrieval: a GraphQL query (getDocumentContent) and a REST endpoint (GET /api/documentapi/{documentapi}/document/{documentId}/content). Both paths authenticate the caller but omit an authorization check tying the caller to the requested document. Any valid portal session can therefore request any document by identifier.

Document identifiers are random and difficult to brute-force. However, identifiers routinely leak through email notifications, logs, URL referrers, support tickets, and third-party integrations. Once an identifier is known, the attacker reads the full document contents, which may include personally identifiable information (PII) governed by GDPR.

Root Cause

The root cause is a missing authorization check [CWE-285] in the document retrieval handlers. The backend relied on identifier opacity rather than enforcing an ownership or relationship predicate between the authenticated principal and the target document resource.

Attack Vector

Exploitation requires network access to the portal and valid portal credentials. The attacker needs only a document identifier belonging to another user. Submitting that identifier to either the GraphQL query or the REST endpoint returns the document content without further checks.

The patch in 3.0.3 removes the insecure GraphQL query entirely and reworks document download handling. The build file for zgw/documenten-api drops its dependency on the :graphql project, and DocumentenApiAutoConfiguration.kt removes the import for DocumentContentQuery:

 dependencies {
 
     api(project(":core"))
-    api(project(":graphql"))
     api(project(":portal-authentication"))
     api(project(":zgw:common-ground-authentication"))
     api(project(":zgw:idtoken-authentication"))

 import nl.nlportal.core.ssl.ResourceClientSslContextResolver
 import nl.nlportal.documentenapi.client.DocumentApisConfig
 import nl.nlportal.documentenapi.client.DocumentenApiClient
-import nl.nlportal.documentenapi.graphql.DocumentContentQuery
 import nl.nlportal.documentenapi.service.DocumentenApiService
 import nl.nlportal.idtokenauthentication.service.IdTokenGenerator
 import org.springframework.beans.factory.annotation.Autowired

Source: GitHub Commit 6e738a8

Detection Methods for CVE-2026-54683

Indicators of Compromise

• Portal access logs showing a single authenticated user requesting document identifiers associated with multiple unrelated accounts.
• GraphQL request bodies invoking getDocumentContent with document IDs that do not belong to the authenticated subject.
• REST calls to /api/documentapi/{documentapi}/document/{documentId}/content where documentId cannot be correlated to the caller's cases.

Detection Strategies

• Correlate authentication identity (BSN, KvK, or portal user ID) with the owner of each requested documentId and alert when they diverge.
• Baseline the typical volume of document retrievals per user per session and flag statistical outliers.
• Review historical GraphQL and REST logs for enumeration patterns against the document endpoints prior to upgrading to 3.0.3.

Monitoring Recommendations

• Enable verbose audit logging on the documenten-api service, capturing caller identity, document identifier, and response size.
• Forward portal application logs to a centralized analytics platform to retain long-term evidence for GDPR breach assessment.
• Alert on bursts of sequential document retrievals from a single session, especially outside normal business hours.

How to Mitigate CVE-2026-54683

Immediate Actions Required

• Upgrade NL Portal Backend Libraries to version 3.0.3 or later across all portal deployments.
• Rotate or invalidate any document identifiers that were exposed in logs, emails, or third-party systems where feasible.
• Review access logs since the vulnerable version was deployed and assess whether unauthorized retrievals occurred for GDPR notification purposes.

Patch Information

The fix is published in GitHub Release 3.0.3.RELEASE. The remediation is tracked in GitHub Pull Request #684 and GitHub Pull Request #690, and documented in GitHub Security Advisory GHSA-jr45-52cw-69h5. Commits 6e738a8 and e326e6d remove the insecure GraphQL query and rework document upload and download handling.

Workarounds

• If immediate upgrade is not possible, restrict access to the GraphQL getDocumentContent query and the /api/documentapi/{documentapi}/document/{documentId}/content REST route at a gateway or reverse proxy layer.
• Add an application-layer authorization filter that validates the authenticated principal against the owning case or zaak for each requested document.
• Minimize distribution of document identifiers in notifications, URLs, and logs to reduce the risk of identifier leakage.

# Example: block the vulnerable endpoints at an NGINX reverse proxy until upgrade
location ~ ^/api/documentapi/[^/]+/document/[^/]+/content$ {
    return 403;
}

location = /graphql {
    if ($request_body ~* "getDocumentContent") {
        return 403;
    }
    proxy_pass http://nlportal_backend;
}