A critical authorization bypass vulnerability in the Dutch Government nl-portal-backend-libraries allows authenticated users to access and manipulate sensitive task data belonging to other users.

This vulnerability is an authorization bypass (CWE-639) occurring within the submitTaakV2 GraphQL mutation. It allows any authenticated user who identifies a valid task ID to read, modify, or complete tasks belonging to other users without authorization.

The ability for unauthorized users to access and alter government portal submissions poses a severe risk to data integrity and privacy. Given the CVSS score of 8.1, this high-severity flaw could lead to the exposure of sensitive citizen information, fraudulent completion of government tasks, and a significant loss of public trust in portal services.

Immediate Action: Upgrade the nl-portal-backend-libraries package to version 3.0.1 or later to implement the necessary ownership verification.

Proactive Monitoring: Review API gateway logs for unusual patterns in GraphQL mutation requests, specifically focusing on unauthorized attempts to access or modify task IDs.

Compensating Controls: If immediate patching is not possible, block the submitTaakV2 mutation at the API gateway or restrict access to the /graphql endpoint to known trusted internal networks.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a significant security oversight that could lead to widespread data manipulation across government portals. Administrators should prioritize the update to version 3.0.1 immediately to close the authorization gap. Until the patch is applied, ensure that strict network-level access controls are in place to limit the exposure of the vulnerable GraphQL endpoint.