CVE-2026-49464— NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak
Quick assessment
Affected
nl-portal nl-portal-backend-libraries
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
NL Portal 后端库为荷兰政府门户提供后端组件，这些门户用于与居民、客户、供应商和合作伙伴组织进行交互。从 1.5.0 到 3.0.0 版本的 包在处理 GraphQL 突变（mutation）时未验证资源所有权，这使得已知或能够猜到他人任务 ID 的已认证用户可以读取其表单数据、覆盖其提交的数据，并将该任务标记为已完成。该问题在 3.0.1 版本中已修复。作为临时规避措施，可在 API 网关层拦截 突变，或将 端点限制在受信任的网络内访问。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-49464
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak
Source: CVE Program / CVE List V5
Vulnerability Description
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:taak` package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the `submitTaakV2` GraphQL mutation, allowing an authenticated user who knows or guesses another user’s task ID to read its form data, overwrite its submitted data, and mark the task as completed. Version 3.0.1 contains a patch. As a workaround, block the `submitTaakV2` mutation at the API gateway or restrict the `/graphql` endpoint to trusted networks
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| nl-portal | nl-portal-backend-libraries | >= 1.5.0, < 3.0.1 | - |
|
II. Public POCs for CVE-2026-49464
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49464
请登录查看更多情报信息。
Other References for CVE-2026-49464 (1)
Same Patch Batch · nl-portal · 2026-09-11 · 3 CVEs total
| CVE-2026-49463 | 6.5 MEDIUM | NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-p |
| CVE-2026-49462 | 5.3 MEDIUM | nl.nl-portal:app has GraphiQL UI and GraphQL schema introspection enabled by default |
IV. Related Vulnerabilities
Same weakness: CWE-639
-
CVE-2026-62134
WordPress Starter Templates plugin <= 4.7.5 - Insecure Direc -
CVE-2026-62113
WordPress Slim SEO plugin <= 4.10.0 - Insecure Direct Object -
CVE-2026-62140
WordPress Quiz And Survey Master plugin <= 11.2.5 - Insecure -
CVE-2026-89264
MoguBlog through 6.2 Comment Author Spoofing via Request-Bod -
CVE-2026-89262
MoguBlog through 6.2 Arbitrary Comment Deletion via Request-
V. Comments for CVE-2026-49464
No comments yet