Description

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:documenten-api` package through version 3.0.0 and the `nl.nl-portal:besluiten` package from version 1.5.0 through 3.0.0 lack per-user authorization in GraphQL resolvers, allowing an authenticated user to access other users’ document contents, decisions, audit trails, and decision attachments. Version 3.0.1 contains a patch. As a workaround, block the affected document-content and decision-related GraphQL operations at the API gateway or block their GraphQL types entirely.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-11T20:17:13.633Z",
  "pubdate": "2026-09-11T20:17:13.633Z",
  "executiveSummary": "The vulnerability is identified as a Broken Object Level Authorization (BOLA) flaw within the GraphQL implementation of the NL Portal Backend Libraries. Specifically, the nl.nl-portal:documenten-api (through version 3.0.0) and nl.nl-portal:besluiten (versions 1.5.0 through 3.0.0) packages fail to validate user authorization contexts during GraphQL resolver execution.\nThis flaw allows a malicious authenticated user to bypass logical access controls, enabling unauthorized retrieval of sensitive data belonging to other users, organizations, or government entities. The exposed data includes document contents, official decisions, audit trails, and associated decision attachments.\nThe risk implication is critical, as it facilitates unauthorized horizontal privilege escalation and large-scale data exfiltration of private citizen or supplier information. Exploitation requires the attacker to be an authenticated user of the portal, which grants them access to the GraphQL endpoint. Once authenticated, an attacker can manipulate GraphQL queries to request sensitive objects by identifier without the backend system verifying if the requester possesses the appropriate permissions to view the specific object. This vulnerability represents a significant failure in the application's authorization layer, potentially violating regulatory requirements for data privacy and confidentiality.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of authorization logic within the GraphQL resolvers of the nl.nl-portal:documenten-api and nl.nl-portal:besluiten components. In a secure GraphQL implementation, each resolver is responsible for verifying that the authenticated principal is authorized to perform the requested operation on the specific object ID provided in the query arguments.\nIn this instance, the resolvers fail to perform an ownership check or access control list (ACL) lookup prior to executing the data fetch operation. Consequently, the application treats any authorized session as having implicit access to all objects referenced within the GraphQL schema, regardless of their actual scope or ownership.\nThe attack flow follows a predictable pattern of exploitation: First, an attacker authenticates normally to the NL Portal as a valid user. Second, the attacker inspects the GraphQL schema to identify the queries associated with document retrieval, decision viewing, and audit trail fetching. Third, the attacker crafts malicious GraphQL queries. For example, by providing the unique identifier (UUID) of a document belonging to another user, the attacker executes a 'query' or 'mutation' that the backend resolves without performing a 'subject-to-object' permission validation.\nBecause the vulnerability is located at the resolver level, the exploitation method is entirely performed via standard GraphQL queries over the existing API interface. The server, trusting the integrity of the request simply because the user holds a valid session token, retrieves the requested sensitive entity from the underlying database or microservice and returns the result in the JSON response body. The scope of impact includes unauthorized access to:\n1. Document contents and attachments: Access to sensitive, potentially personal, files belonging to other residents or partners.\n2. Official Decisions: Access to sensitive decision-making data.\n3. Audit Trails: Exfiltration of logs which may reveal sensitive portal activity, further aiding in reconnaissance or tracking of other users.\nThe vulnerability affects nl.nl-portal:documenten-api versions up to and including 3.0.0, and nl.nl-portal:besluiten versions 1.5.0 through 3.0.0. Authentication is required to access the API, but no elevated privileges are necessary; any standard authenticated user can access any record if they possess the object identifier."
}