High severity · published Sep 11, 2026
CVE-2026-49464
NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak
8.1
CVSS
0.4%
EPSS
No
On KEV
Description
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:taak` package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the `submitTaakV2` GraphQL mutation, allowing an authenticated user who knows or guesses another user’s task ID to read its form data, overwrite its submitted data, and mark the task as completed. Version 3.0.1 contains a patch. As a workaround, block the `submitTaakV2` mutation at the API gateway or restrict the `/graphql` endpoint to trusted networks
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NL
nl-portal-backend-libraries · nl-portal
>= 1.5.0, < 3.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-49464
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-49464
github.com
https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-6h3c-r723-7fx3
More from nl-portal-backend-libraries
6.5
CVE-2026-54683
NL Portal Backend Libraries: Document contents remained downloadable by any logged-in user until 3.0.3 (incomplete fix of CVE-2026-49463)
5.3
CVE-2026-55414
NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)