CVE-2026-55414

Name of the Vulnerable Software and Affected Versions NL Portal Backend Libraries versions 1.1.0 through 3.0.3 NL Portal Backend Libraries version 3.1.0

Description Unauthenticated users can access the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL resolvers via the /graphql endpoint. These resolvers forward a caller-influenced URL to the getObjectByUrl() function in ObjectenApiService, which then calls getObjectByUrl() in ObjectsApiClient. This process attaches a privileged Objecten-API token to the request. While a host-equality check is performed, it does not validate the scheme, port, or path, allowing an attacker to induce a token-bearing request to any endpoint on the configured Objecten-API host. This results in a constrained server-side request forgery (SSRF) combined with missing authorization. Due to typed deserialization, the returned data is limited to objects shaped like form definitions.

Recommendations Upgrade NL Portal Backend Libraries to version 3.0.4 or later. As a temporary mitigation, restrict access to the /graphql endpoint or disable the getFormDefinitionByObjectenApiUrl and getFormDefinitionById resolvers.