CVE-2026-49464

The nl.nl-portal:taak package, part of the NL Portal Backend Libraries used to build Dutch government portals, fails to verify task ownership when handling the submitTaakV2 GraphQL mutation. An authenticated user who knows or guesses another user's task ID (an IDOR, CWE-639) can invoke the mutation against that ID. The attacker gains the ability to read the victim task's form data, overwrite its submitted data, and mark the task as completed, resulting in high confidentiality and integrity impact without availability loss. Any deployment of NL Portal Backend Libraries using the taak module between version 1.5.0 and 3.0.0 is affected, primarily Dutch public-sector portals serving residents, customers, suppliers, and partners. No public proof-of-concept or in-the-wild exploitation is known, and the issue is not in CISA KEV.

What to do: Upgrade the nl.nl-portal:taak dependency to version 3.0.1 or later, which contains the ownership check patch. If upgrading is not immediately possible, block the submitTaakV2 mutation at the API gateway or restrict the /graphql endpoint to trusted networks. Also audit existing tasks for unexpected completions or modified submissions, since task IDs may have been guessed by other authenticated users.