CVE-2026-54683: CWE-285: Improper Authorization in nl-portal nl-portal-backend-libraries

NL Portal Backend Libraries provide backend components for Dutch government portals. Versions before 3.0.3 have an authorization flaw (CWE-285) in the getDocumentContent GraphQL query and the GET /api/documentapi/{documentapi}/document/{documentId}/content REST endpoint. These endpoints allow any authenticated user to retrieve documents without verifying ownership or authorization. Although document IDs are random and hard to guess, leakage through other channels can lead to unauthorized access to sensitive personal data. The vulnerability is fixed in version 3.0.3.

An authenticated user can read documents belonging to other users without proper authorization checks. This can lead to exposure of sensitive personal information. The vulnerability does not affect confidentiality beyond document contents, nor does it impact integrity or availability. The CVSS score is 6.5 (medium severity) with network attack vector, low attack complexity, and requiring privileges but no user interaction.

Upgrade nl-portal-backend-libraries to version 3.0.3 or later, where the authorization checks have been properly implemented. Until then, restrict access to authenticated users carefully and monitor for potential document ID leakage. No other vendor advisories or temporary fixes are provided.