Unauthorized Access Vulnerability in NL Portal Backend Libraries

CVE-2026-55414

What is CVE-2026-55414?

The NL Portal Backend Libraries contain a vulnerability that allows unauthorized access to GraphQL resolvers, specifically getFormDefinitionByObjectenApiUrl and the deprecated getFormDefinitionById. These resolvers can be targeted by unauthenticated callers, potentially allowing them to manipulate URLs that interact with ObjectsApiClient. As the host-equality check only validates the configured Objecten-API host, it fails to verify the scheme, port, or path, which could lead to exposure of a token-bearing request. This creates risks for sensitive data leakage despite standard deployments not exposing direct cross-host SSRF threats. Versions up to 3.0.4 are affected, while 3.0.4 has mitigations in place.

References