Description

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:taak` package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the `submitTaakV2` GraphQL mutation, allowing an authenticated user who knows or guesses another user’s task ID to read its form data, overwrite its submitted data, and mark the task as completed. Version 3.0.1 contains a patch. As a workaround, block the `submitTaakV2` mutation at the API gateway or restrict the `/graphql` endpoint to trusted networks

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-11T21:17:10.523Z",
  "pubdate": "2026-09-11T21:17:10.523Z",
  "executiveSummary": "The NL Portal Backend Libraries, specifically the nl.nl-portal:taak package, contain a critical broken access control vulnerability. This vulnerability resides in the submitTaakV2 GraphQL mutation and affects all versions from 1.5.0 through 3.0.0.\nThe flaw allows an authenticated attacker to perform unauthorized actions on tasks belonging to other users. By manipulating the task identifier within the GraphQL request, an attacker can bypass authorization checks, leading to unauthorized data disclosure, data modification, and illegitimate task completion.\nThe impact is severe, potentially compromising the integrity and confidentiality of sensitive government portal data. Successful exploitation requires the attacker to be authenticated to the system and possess or successfully guess a valid target task ID. Mitigation is achieved by upgrading to version 3.0.1 or implementing restrictive access controls at the API gateway.",
  "technicalDetails": "The vulnerability is rooted in a failure to perform server-side ownership verification during the processing of the submitTaakV2 GraphQL mutation. In the nl.nl-portal:taak component, the backend service receives a task ID as an input parameter for the mutation but fails to validate whether the authenticated user associated with the session context possesses the necessary authorization to interact with the specified task.\nThis represents a classic Insecure Direct Object Reference (IDOR) pattern. Because the GraphQL resolver lacks an explicit check to compare the authenticated user's unique identifier against the owner ID stored in the database for the requested task, the system implicitly trusts the user-supplied task ID.\nThe exploitation flow proceeds as follows: First, the attacker establishes an authenticated session with the target application. Second, the attacker identifies the GraphQL endpoint, typically exposed at /graphql, and constructs a malformed request targeting the submitTaakV2 mutation. Third, the attacker iterates or probes the task ID parameter; if the attacker knows or guesses a valid task ID belonging to a different victim, the backend processes the mutation for that specific entity regardless of ownership.\nThe functional impact is comprehensive. Upon sending the malicious payload, the attacker can: 1) Read sensitive form data associated with the victim's task, resulting in an unauthorized information disclosure; 2) Overwrite existing form data, leading to a loss of data integrity; and 3) Execute a completion transition on the task, which may trigger unintended backend workflows, notification alerts, or state transitions in the government portal's management system.\nThe vulnerable component is the taak management module within the NL Portal Backend Libraries. The flaw is present in versions 1.5.0 through 3.0.0. The exploit does not require administrative privileges, merely a valid, authenticated user account. The vulnerability is exploitable over the network, as the GraphQL interface is intended for backend interaction between frontend portals and the core backend service."
}