https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T01:56:06.338958+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-367050 EUVD-2026-367050 2026-10-08T01:56:06.390414+00:00 EUVD-2026-367050 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49463 fkie_cve-2026-49463 2026-10-08T01:56:06.390452+00:00

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:documenten-api` package through version 3.0.0 and the `nl.nl-portal:besluiten` package from version 1.5.0 through 3.0.0 lack per-user authorization in GraphQL resolvers, allowing an authenticated user to access other users’ document contents, decisions, audit trails, and decision attachments. Version 3.0.1 contains a patch. As a workaround, block the affected document-content and decision-related GraphQL operations at the API gateway or block their GraphQL types entirely.

 https://cve.radiocsirt.org/vuln/ghsa-qpm9-h556-mwxm GHSA-qpm9-h556-mwxm — NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries 2026-10-08T01:56:06.390492+00:00

Affected: Maven: nl.nl-portal:documenten-api, Maven: nl.nl-portal:besluiten

## Impact

In versions up to and including 3.0.0, two parts of the GraphQL API returned data without checking whether the data belonged to the logged-in user:

- **Document content.** A logged-in user could download the raw content of any document by its ID, regardless of who owned it. The resolver has lacked an authentication parameter since the initial commit of the project (2022-11-22) — so every version of `nl.nl-portal:documenten-api` ever published is affected (the earliest one on Maven Central is `0.2.2.RELEASE`, published 2023-08-31). - **Decisions (`besluiten`).** A logged-in user could list, search, and read decision records — including their audit trails and the documents attached to them — for any user. The list query also accepted filters (decision type, identification, responsible organisation, related case), which made it easy to enumerate decisions across the user base. The `besluiten` module was introduced in the `1.5.x` release line (commit `9229460b`, 2024-08-19), so versions of `nl.nl-portal:besluiten` from `1.5.0` through `3.0.0` are affected.

Decisions and their attachments often contain sensitive personal data (decisions on benefits, permits, objections, and similar), so the confidentiality impact is high. The two endpoints also chain naturally: once an attacker has discovered another user's document IDs by enumerating decisions, they can pull those documents' contents through the document endpoint.

### Why these two findings are reported together

T…