CyberRota Analysis
AI-GeneratedThe NL Portal Backend Libraries, specifically the `nl.nl-portal:documenten-api` package (up to version 3.0.0) and the `nl.nl-portal:besluiten` package (from version 1.5.0 to 3.0.0), are vulnerable due to a lack of per-user authorization in GraphQL resolvers, allowing authenticated users to access sensitive data belonging to other users. This vulnerability can lead to unauthorized exposure of document contents, decisions, and audit trails, posing a risk to user privacy and data integrity. Organizations utilizing these libraries should prioritize updating to version 3.0.1 or implementing API gateway workarounds to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:documenten-api` package through version 3.0.0 and the `nl.nl-portal:besluiten` package from version 1.5.0 through 3.0.0 lack per-user authorization in GraphQL resolvers, allowing an authenticated user to access other users’ document contents, decisions, audit trails, and decision attachments. Version 3.0.1 contains a patch. As a workaround, block the affected document-content and decision-related GraphQL operations at the API gateway or block their GraphQL types entirely.