NL Portal Backend Libraries vulnerabilities

In NL Portal Backend Libraries, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL resolvers are reachable without CommonGroundAuthentication and forward a caller-influenced URL through ObjectenApiService.getObjectByUrl to ObjectsApiClient.getObjectByUrl, which attaches the privileged Objecten-API token. The host-equality check restricts requests to the configured Objecten-API host but does not constrain the scheme, port, or path. The 3.0 line is fixed in 3.0.4; the advisory does not identify a fixed 3.1 release.

In NL Portal Backend Libraries, both the getDocumentContent GraphQL query and the GET /api/documentapi/{documentapi}/document/{documentId}/content REST route allow any authenticated portal user to retrieve a document without checking ownership of or another authorized relationship to it. A user with a valid login and another person's document identifier can read that document's contents, which may include sensitive personal information. Fixed in version 3.0.3.

The nl.nl-portal:documenten-api package (through 3.0.0) and nl.nl-portal:besluiten package (1.5.0 through 3.0.0) lack per-user authorization in GraphQL resolvers, allowing an authenticated user to access other users' document contents, decisions, audit trails, and decision attachments. Version 3.0.1 contains a patch.

In versions up to and including 3.0.0, NL Portal Backend Libraries deployments using the shipped default configuration exposed two GraphQL developer features without authentication: the GraphiQL playground and schema introspection. Anyone able to reach the /graphiql endpoint could pull the full schema and use it to map out the API and craft calls against it. Version 3.0.1 patches the issue.