Read the docs
TI-2026-74868 Aliases CVE-2026-55414

Server-side request forgery in NL Portal Backend Libraries

Priority MEDIUM 63CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862, CWE-918 and the CVSS impact.

Summary

NL Portal Backend Libraries from 1.1.0 before 3.0.4 and version 3.1.0 are affected. The public getFormDefinitionByObjectenApiUrl GraphQL resolver is reachable without authentication and forwards a caller-supplied URL with the privileged Objecten-API token (CWE-918). The host check does not constrain scheme, port or path, so an unauthenticated remote attacker can make the server send that token to a chosen endpoint on the configured host.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL resolvers are reachable without CommonGroundAuthentication and forward a caller-influenced URL through ObjectenApiService.getObjectByUrl to ObjectsApiClient.getObjectByUrl, which attaches the privileged Objecten-API token. The host-equality check restricts requests to the configured Objecten-API host but does not constrain the scheme, port, or path, allowing an unauthenticated caller to induce a token-bearing request to a chosen endpoint on that host. Standard deployments are not exposed to cross-host SSRF, token capture requires attacker-controlled routing on the configured host, and typed deserialization limits returned data to objects shaped like form definitions. The 3.0 release line is fixed in version 3.0.4. The advisory does not identify a fixed 3.1 release.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00437 38th percentileScored 2026-11-07
Fix Fixed nl-portal-backend-libraries (nl-portal): 3.0.4nl.nl-portal:form (Maven): 3.0.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nl-portalnl-portal-backend-libraries1.1.0 to before 3.0.4; = 3.1.03.0.4Patch availableCNA
—nl.nl-portal:form (Maven)1.1.0 to before 3.0.43.0.4Patch availableGHSA-xm3x-9cfw-jhx4
  • nl-portal-backend-libraries Vendornl-portal Affected 1.1.0 to before 3.0.4; = 3.1.0 Fixed in 3.0.4 Patch available CNA
  • nl.nl-portal:form (Maven) Vendor— Affected 1.1.0 to before 3.0.4 Fixed in 3.0.4 Patch available GHSA-xm3x-9cfw-jhx4

Remediation

The nl.nl-portal:form Maven package is fixed in 3.0.4, which covers the 3.0 release line. The sources list no fixed version for nl-portal-backend-libraries.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA nl-portal-backend-libraries (nl-portal) Fixed in 3.0.4
  • Fix · GHSA-xm3x-9cfw-jhx4 nl.nl-portal:form (Maven) Fixed in 3.0.4 Advisory →

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-55414

References

Other 5

  • TI-2026-74865 Missing authorization in NL Portal Backend Libraries exposes documents CVSS 3.1MEDIUM 6.5
  • TI-2026-36619 NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak CVSS 3.1HIGH 8.1
  • TI-2026-36617 nl.nl-portal:app has GraphiQL UI and GraphQL schema introspection enabled by default CVSS 3.1MEDIUM 5.3
  • TI-2026-36618 NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences