Nl Portal Backend Libraries
Approved changes feed: RSS · Atom
cpe:2.3:a:nl-portal:nl-portal-backend-libraries:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Nl Portal (57e7beca-4d02-5ec3-ad9d-e13007332b91) |
|---|---|
| Product | Nl Portal Backend Libraries (be62e1f3-e64b-5725-9d73-3ffe4d093624) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-49464 |
vulnerable | 2026-09-16 04:32:55.705388 |
NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak
HIGH (8.1)
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:taak` package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the `submitTaakV2` GraphQL mutation, allowing an authenticated user who knows or guesses another user’s task ID to read its form data, overwrite its submitted data, and mark the task as completed. Version 3.0.1 contains a patch. As a workaround, block the `submitTaakV2` mutation at the API gateway or restrict the `/graphql` endpoint to trusted networks
Published: 2026-09-11T20:34:14.230Z
Updated: 2026-09-15T16:36:50.488Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.