CVE-2026-54683: 
Java vulnerability analysis and mitigation

CVE-2026-54683 is an improper authorization vulnerability in the NL Portal Backend Libraries (nl.nl-portal:documenten-api) that allows any authenticated portal user to download documents belonging to other users. It is a follow-up to CVE-2026-49463 (GHSA-qpm9-h556-mwxm), whose fix in version 3.0.1 was incomplete — the authentication parameter added to the GraphQL query was never enforced, and a vulnerable REST endpoint was left entirely unaddressed through versions 3.0.1 and 3.0.2. The issue was fully resolved only in version 3.0.3. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory). The advisory was published on June 17–18, 2026, and was reported by independent security researcher Ray Sabee of whitehatsecurity.nl (GitHub Advisory).

The root cause is classified as CWE-285 (Improper Authorization) and CWE-639 (Authorization Bypass Through User-Controlled Key). Two document-content retrieval mechanisms failed to verify the caller's ownership of or relationship to the requested document: a REST endpoint (GET /api/documentapi/{documentapi}/document/{documentId}/content) and a GraphQL query (getDocumentContent). The 3.0.1 patch added an authentication parameter to the GraphQL query but never used it in the authorization logic, rendering the fix ineffective; additionally, a security rule intended to guard the REST endpoint pointed at the wrong URL and never took effect. An attacker only needed a valid session and a target document's UUID — which, while random, can leak through other application channels — to retrieve arbitrary documents (GitHub Advisory, Security Advisory).

A logged-in portal user could read the full contents of documents belonging to other citizens or businesses without any ownership relationship to those documents. In citizen or government service portals — the primary deployment context for NL Portal — these documents frequently contain sensitive personal information such as identity records, case files, or official correspondence. There is no integrity or availability impact; the vulnerability is limited to confidentiality, but the exposure of personal data in government portals carries significant privacy and regulatory risk (GitHub Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires a valid authenticated session, which limits the attack surface to registered portal users. However, the advisory itself includes a straightforward proof-of-concept request (GET /api/documentapi/openzaak/document/<uuid>/content), making exploitation trivial for any authenticated user who can obtain or guess a target document UUID. No CISA KEV listing or threat actor attribution has been identified. The CVE status is listed as Reserved, and no EPSS score is currently available (GitHub Advisory).

1. Obtain authentication: Log in to the NL Portal as any valid registered user to acquire a session token or cookie.
2. Identify a target document UUID: Obtain a target document's UUID through any available channel — e.g., observing UUIDs in API responses during normal portal use, intercepting network traffic, or leveraging other application features that expose document identifiers.
3. Send a crafted REST request: Issue an authenticated HTTP GET request to the vulnerable endpoint:

   GET /api/documentapi/openzaak/document/<target-document-uuid>/content

   Include the session credentials (cookie or Authorization header) from step 1.
4. Retrieve document contents: The server responds with HTTP 200 and returns the full document contents, regardless of whether the authenticated user has any relationship to that document.
5. Alternatively, use GraphQL: Send an authenticated getDocumentContent GraphQL query with the target document's UUID and API identifier — the server performs no ownership check and returns the document content. (GitHub Advisory, Security Advisory)

• Network: Authenticated HTTP GET requests to /api/documentapi/*/document/*/content where the requesting user has no case or message relationship to the document UUID; high volume of such requests from a single authenticated session targeting multiple different document UUIDs.
• Logs: Application access logs showing HTTP 200 responses to /api/documentapi/{documentapi}/document/{documentId}/content for users who do not own the referenced documents; GraphQL query logs showing getDocumentContent calls with document UUIDs not associated with the authenticated user's cases or messages.
• Behavioral: A single authenticated user account making sequential requests for many different document UUIDs in a short time window, suggesting enumeration or bulk harvesting of documents. (GitHub Advisory)

Upgrade nl.nl-portal:documenten-api to version 3.0.3 or later, which removes both the vulnerable REST endpoint and the getDocumentContent GraphQL query entirely. Document downloads in 3.0.3 are only available through scoped endpoints that verify the caller has a role on the related case (zaak) or owns the message (bericht) the document is attached to. If immediate upgrade is not possible, block GET /api/documentapi/*/document/*/content and the getDocumentContent GraphQL query at your API gateway or reverse proxy, and remove any client-side code that calls these endpoints. Audit access logs to identify any unauthorized document downloads that may have already occurred (GitHub Advisory, Security Advisory).

The vulnerability was reported by independent security researcher Ray Sabee of whitehatsecurity.nl and credited in the official advisory (Security Advisory). A Reddit post in r/ethicalhacking noted the researcher receiving CVE credit for this finding. No broader media coverage or significant community discussion has been identified beyond the GitHub advisory and the researcher's disclosure.