NL Portal Backend Libraries allowed any logged‑in user to retrieve the content of any document via the getDocumentContent GraphQL query or a REST endpoint that did not verify the user's relationship to the document. The result is that sensitive personal information may be viewed by users without ownership, a confidentiality breach that aligns with CWE‑285 (Improper Authorization) and CWE‑639 (Authorization Bypass Through User‑Controlled Key).

Vendors must upgrade to nl‑portal‑backend‑libraries version 3.0.3 or later. Earlier releases, up through 3.0.2, lacked the authorization guard on document retrieval. The affected components are the GraphQL services and the /api/documentapi/{documentapi}/document/{documentId}/content REST path within the nl‑portal‑backend‑libraries product.

With a CVSS score of 6.5, the vulnerability is considered moderate to high severity. The EPSS indicates an exploitation probability of less than 1 %, and the issue is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. However, the attack vector does not require additional privileges beyond a valid user login, so any authenticated user could exploit it if other mitigating controls are not in place.