CVE-2026-49463: 
Java vulnerability analysis and mitigation

CVE-2026-49463 is a missing per-user authorization vulnerability in the NL Portal backend libraries (nl-portal-backend-libraries) affecting two GraphQL API components: nl.nl-portal:documenten-api (all versions through 3.0.0, back to 0.2.2.RELEASE published 2023-08-31) and nl.nl-portal:besluiten (versions 1.5.0 through 3.0.0). The flaw allows any authenticated portal user to access documents and decision records belonging to other users. It was discovered during a penetration testing engagement in May 2026, first published on June 3, 2026, and formally added to the GitHub Advisory Database on July 8, 2026. The CVSS v3.1 base score is 6.5 (Medium) (GitHub Advisory, NL Portal Advisory).

The root cause is improper authorization (CWE-285) and exposure of sensitive information to unauthorized actors (CWE-200). Both vulnerable GraphQL resolvers — DocumentContentQuery.getDocumentContent() and BesluitenQuery — were declared without a CommonGroundAuthentication parameter on their method signatures, meaning the Spring framework never bound the authenticated principal into the resolver's call path. As a result, no per-user ownership check was ever performed: getDocumentContent accepted any document UUID and returned its raw content, while the six BesluitenQuery operations (getBesluiten, getBesluit, getBesluitAuditTrails, getBesluitAuditTrail, getBesluitDocumenten, getBesluitDocument) accepted filter arguments such as besluitType, identificatie, and zaak without scoping results to the calling user. The two endpoints chain naturally — an attacker can enumerate other users' document IDs via the decisions API and then exfiltrate document content via the document endpoint (GitHub Advisory).

Successful exploitation results in a high-confidentiality breach with no integrity or availability impact. Any authenticated portal user can enumerate decision records (including audit trails and attached documents) across the entire user base and download the raw content of any document by its UUID. Decisions in NL Portal frequently contain sensitive personal data such as benefit decisions, permits, and objections, making this a significant privacy risk for all portal users. The chained attack path — enumerate via getBesluiten, exfiltrate via getDocumentContent — enables systematic bulk data harvesting of other users' personal records (GitHub Advisory, NL Portal Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). Exploitation requires only a valid authenticated session on the portal (low privileges required), no user interaction, and is reachable over the network with low attack complexity, making it straightforward for any registered portal user to attempt. No threat actor attribution, CISA KEV listing, or exploit kit involvement has been reported. The EPSS score is not yet published.

1. Authenticate: Obtain a valid user account on the target NL Portal instance (e.g., register as a legitimate portal user or use compromised credentials).
2. Enumerate decisions: Send a GraphQL query to the getBesluiten endpoint with optional filter arguments (e.g., besluitType, identificatie, verantwoordelijkeOrganisatie, zaak, pageNumber) to list decision records across all users without any ownership restriction.

   query {
     getBesluiten(pageNumber: 1) {
       content {
         id
         identificatie
         besluittype
         zaak
         documenten { id }
       }
     }
   }

3. Extract document IDs: From the returned decision records, collect document UUIDs belonging to other users via getBesluitDocumenten or the embedded document references.
4. Exfiltrate document content: Use the getDocumentContent GraphQL query with each harvested document UUID to download the raw content of documents owned by other users.

   query {
     getDocumentContent(id: "<victim-document-uuid>") {
       content
       bestandsnaam
     }
   }

5. Repeat at scale: Iterate through paginated decision results and all extracted document IDs to systematically harvest sensitive personal data across the user base (GitHub Advisory).

• Network: Unusual volume of GraphQL POST requests to the portal's GraphQL endpoint from a single authenticated session, particularly queries for getBesluiten, getBesluit, getBesluitAuditTrails, getBesluitAuditTrail, getBesluitDocumenten, getBesluitDocument, or getDocumentContent.
• Logs: Application or API gateway logs showing a single user account issuing repeated getBesluiten queries with varying filter parameters (besluitType, identificatie, zaak, pageNumber) in rapid succession; getDocumentContent queries referencing document UUIDs not associated with the authenticated user's own records.
• Behavioral: A single authenticated user account accessing an abnormally large number of distinct document IDs or decision records within a short time window, especially across multiple pageNumber values in getBesluiten queries (GitHub Advisory).

Upgrade both affected packages to version 3.0.1 or later: nl.nl-portal:documenten-api (fix commit 32e0ebdf — adds CommonGroundAuthentication parameter to the resolver) and nl.nl-portal:besluiten (fix commit f592af1b — removes the entire BesluitenQuery module). Consumers relying on besluiten functionality must implement a replacement at the application layer with explicit per-user authorization before upgrading. For deployments that cannot upgrade immediately, block the following GraphQL operations at the API gateway: getDocumentContent, getBesluiten, getBesluit, getBesluitAuditTrails, getBesluitAuditTrail, getBesluitDocumenten, and getBesluitDocument. Additionally, review access logs to identify any unauthorized document or decision access that may have already occurred (GitHub Advisory, NL Portal Advisory).