CVE-2026-55414
MediumCVSS 5.3Summary
In NL Portal Backend Libraries, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL resolvers are reachable without CommonGroundAuthentication and forward a caller-influenced URL through ObjectenApiService.getObjectByUrl to ObjectsApiClient.getObjectByUrl, which attaches the privileged Objecten-API token. The host-equality check restricts requests to the configured Objecten-API host but does not constrain the scheme, port, or path. The 3.0 line is fixed in 3.0.4; the advisory does not identify a fixed 3.1 release.
Risk Assessment
An unauthenticated caller can induce a token-bearing request to a chosen endpoint on the configured host, potentially leading to token capture or SSRF within that host. Standard deployments are not exposed to cross-host SSRF, and token capture requires attacker-controlled routing on the configured host.
Recommendation
Update the 3.0 line to version 3.0.4 or later and verify whether the 3.1 version in use contains the fix. Consider enforcing authentication on the GraphQL resolvers and constraining the scheme, port, and path for Objecten-API requests.
Other vulnerabilities in NL Portal Backend Libraries
See all- CVE-2026-54683Medium
In NL Portal Backend Libraries, both the getDocumentContent GraphQL query and the GET /api/documentapi/{documentapi}/document/{documentId}/content REST route allow any authenticated portal user to retrieve a document without checking ownership of or another authorized relationship to it. A user with a valid login and another person's document identifier can read that document's contents, which may include sensitive personal information. Fixed in version 3.0.3.
- CVE-2026-49463Medium
The nl.nl-portal:documenten-api package (through 3.0.0) and nl.nl-portal:besluiten package (1.5.0 through 3.0.0) lack per-user authorization in GraphQL resolvers, allowing an authenticated user to access other users' document contents, decisions, audit trails, and decision attachments. Version 3.0.1 contains a patch.
- CVE-2026-49462Medium
In versions up to and including 3.0.0, NL Portal Backend Libraries deployments using the shipped default configuration exposed two GraphQL developer features without authentication: the GraphiQL playground and schema introspection. Anyone able to reach the /graphiql endpoint could pull the full schema and use it to map out the API and craft calls against it. Version 3.0.1 patches the issue.
Original NVD description (English source)
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL resolvers are reachable without CommonGroundAuthentication and forward a caller-influenced URL through ObjectenApiService.getObjectByUrl to ObjectsApiClient.getObjectByUrl, which attaches the privileged Objecten-API token. The host-equality check restricts requests to the configured Objecten-API host but does not constrain the scheme, port, or path, allowing an unauthenticated caller to induce a token-bearing request to a chosen endpoint on that host. Standard deployments are not exposed to cross-host SSRF, token capture requires attacker-controlled routing on the configured host, and typed deserialization limits returned data to objects shaped like form definitions. The 3.0 release line is fixed in version 3.0.4. The advisory does not identify a fixed 3.1 release.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS