CVE-2026-49464: 
Java vulnerability analysis and mitigation

CVE-2026-49464 is an Insecure Direct Object Reference (IDOR) vulnerability in the NL Portal backend libraries (nl.nl-portal:taak) that allows any authenticated portal user to complete and tamper with another user's open task. It affects versions 1.5.0 through 3.0.0 of the Maven package nl.nl-portal:taak, with version 3.0.1 containing the fix. The vulnerability was discovered during a penetration testing engagement in May 2026, first published on June 3, 2026, and added to the GitHub Advisory Database on July 8, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory).

The root cause is an Authorization Bypass Through User-Controlled Key (CWE-639): the GraphQL resolver nl.nlportal.zgw.taak.service.TaakService.submitTaakV2(id, submission, authentication) accepted a task UUID and immediately transitioned the task to the AFGEROND (completed) state, writing caller-supplied data to record.data.portaalformulier.verzondenData, without verifying that the task's identificatie matched the authenticated user. An attacker with a valid burger OAuth token who knows or guesses another user's task UUID can invoke the submitTaakV2 GraphQL mutation to exploit this flaw. The vulnerable code was introduced with the Taak V2 implementation (commit bb1c1ecf, 2024-06-04) and first shipped in the 1.5.x release line. The fix (commit 8e699add) adds a call to isAuthorizedForTaak(authentication, objectsApiTask) that validates identificatie.type, identificatie.value, and the task's eigenaar before allowing the state change (GitHub Advisory, NL Portal Advisory).

Successful exploitation allows an authenticated attacker to mark any other user's task as completed, overwrite the form data (verzonden_data) submitted with that task with arbitrary input, and read the full task object returned in the GraphQL response — including personal data the legitimate owner had previously entered. This results in high confidentiality impact (exposure of other users' form data) and high integrity impact (unauthorized modification and submission of forms on behalf of other users), with no availability impact. The vulnerability is particularly sensitive in government or civic portal contexts where tasks may contain personally identifiable information (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported. Exploitation requires a valid authenticated session (a burger OAuth token), making it accessible to any registered portal user rather than unauthenticated attackers. Task UUIDs may be guessable or discoverable through normal portal usage, lowering the practical barrier. The CVE status is listed as Reserved and no EPSS score or CISA KEV catalog entry has been identified for this vulnerability (GitHub Advisory).

1. Obtain authentication: Register or log in to the NL Portal as a legitimate user to obtain a valid burger OAuth token.
2. Identify a target task UUID: Discover another user's task UUID through enumeration (e.g., sequential or predictable UUIDs), information leakage in the portal UI, or social engineering.
3. Craft a malicious GraphQL mutation: Construct a submitTaakV2 GraphQL mutation request targeting the victim's task UUID with arbitrary submission data:

mutation {
  submitTaakV2(id: "<victim-task-uuid>", submission: { /* attacker-controlled data */ }) {
    id
    verzondenData
    # additional fields to read victim's previously entered data
  }
}

4. Submit the request: Send the mutation to the /graphql endpoint with the attacker's OAuth token in the Authorization header.
5. Achieve objectives: The task is marked as completed (AFGEROND) under the victim's identity, the victim's original form data is overwritten with the attacker's input, and the full task object (including the victim's previously entered data) is returned in the GraphQL response (GitHub Advisory, NL Portal Advisory).

• Network: GraphQL POST requests to /graphql containing submitTaakV2 mutations with task UUIDs that do not belong to the authenticated user; high volume of submitTaakV2 calls from a single user account targeting multiple different task UUIDs (enumeration pattern).
• Logs: Application logs showing submitTaakV2 invocations where the task's identificatie does not match the authenticated burger principal; repeated task submission attempts with varying UUIDs from the same OAuth token.
• Application Behavior: Tasks appearing as completed (AFGEROND) without corresponding action by the legitimate task owner; unexpected changes to verzonden_data fields in task records; users reporting their in-progress form data was altered or submitted without their action.

Upgrade the nl.nl-portal:taak Maven package to version 3.0.1 or later, which includes fix commit 8e699add ("Add auth check for task submission") (GitHub Advisory). As an interim workaround until the upgrade is applied, block the submitTaakV2 GraphQL mutation at the API gateway level, or restrict access to the /graphql endpoint to trusted networks only. Note that the nl-portal-backend-libraries repository was archived on July 13, 2026, so organizations should verify the migration path for continued support (NL Portal Advisory).