EUVD-2026-76686Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible default endpoint, no auth required; only API schema structure leaked, not user data, making C:L and I:N/A:N accurate.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. In versions up to and including 3.0.0, deployments using the shipped default configuration exposed two GraphQL developer features without requiring authentication: the GraphiQL playground, an interactive UI for issuing GraphQL queries; and schema introspection, which lets a caller download the full description of every query, mutation, type, and argument the API supports. Anyone who could reach the /graphiql endpoint could open the playground in a browser, pull the full schema, and use that to map out the API and craft calls against it. By itself this does not leak user data, but it removes the guesswork from attacking the rest of the API and significantly lowers the bar for finding and exploiting other weaknesses. Version 3.0.1 patches the issue. As a workaround, override the two settings in deployed configuration.
AnalysisAI
Unauthenticated access to the GraphiQL playground and schema introspection endpoints in NL Portal Backend Libraries (up to and including v3.0.0) exposes the complete GraphQL API surface to any network-reachable caller under default deployment configuration. The commit diff confirms the fix is a two-line configuration change disabling both graphiql.enabled and introspection.enabled in the Spring Boot application.yml, indicating these developer features were shipped enabled by default. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the application is deployed using the default shipped configuration (application.yml) without overriding the `spring.graphql.graphiql.enabled` and `spring.graphql.graphiql.introspection.enabled` settings. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 score (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately captures the bounded impact: any unauthenticated remote caller can retrieve the full schema, but no user records, credentials, or mutable state are exposed by this vulnerability alone. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to NL Portal Backend Libraries version 3.0.1, which patches the issue by setting `spring.graphql.graphiql.enabled: false` and `spring.graphql.graphiql.introspection.enabled: false` in the default application.yml. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today