Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Maven package nl.nl-portal:taak versions 1.5.0 up to but not including 3.0.1 contain an insecure direct object reference in the task submission endpoint, which does not check that the task belongs to the caller. Any authenticated portal user who knows or guesses another user's task ID can mark that task completed, overwrite its submitted data, and read the form contents the owner had entered. Upgrade to version 3.0.1 or later. Until then, block the submitTaakV2 GraphQL mutation at the API gateway or restrict the /graphql endpoint to trusted networks.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 8.1 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0035, the 28th percentile, on 7 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:19 UTC First seen by agentprime
- 31 Oct 2026, 14:19 UTC Confirmed by OSV