CVE-2026-55414 Details
Description
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL resolvers are reachable without CommonGroundAuthentication and forward a caller-influenced URL through ObjectenApiService.getObjectByUrl to ObjectsApiClient.getObjectByUrl, which attaches the privileged Objecten-API token. The host-equality check restricts requests to the configured Objecten-API host but does not constrain the scheme, port, or path, allowing an unauthenticated caller to induce a token-bearing request to a chosen endpoint on that host. Standard deployments are not exposed to cross-host SSRF, token capture requires attacker-controlled routing on the configured host, and typed deserialization limits returned data to objects shaped like form definitions. The 3.0 release line is fixed in version 3.0.4. The advisory does not identify a fixed 3.1 release.
A server-side request forgery (SSRF) vulnerability has been identified in NL Portal Backend Libraries, specifically in the form module, which is used for Dutch government portals. The issue affects versions 1.1.0 through 3.0.4, as well as 3.1.0. The vulnerability arises because the public GraphQL resolvers 'getFormDefinitionByObjectenApiUrl' and the deprecated 'getFormDefinitionById' can be accessed without authentication. These resolvers forward a caller-influenced URL to the ObjectsApiClient, attaching a privileged Objecten-API token. While standard deployments do not expose this vulnerability to cross-host SSRF, an attacker could exploit it to capture the token by controlling the routing on the configured Objecten-API host. The vulnerability has been confirmed in a local lab environment, and the impact is assessed as moderate, with a CVSS score of 5.3.
Upgrade NL Portal Backend Libraries to version 3.0.4 or later. This version removes the vulnerable GraphQL resolvers and introduces a new authenticated query that retrieves form definitions without exposing the Objecten-API token.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NL Portal Backend Libraries | >= 1.1.0, <= 1.1.x >= 1.2.5, <= 1.2.x >= 1.3.0, <= 1.3.x >= 3.0.0, <= 3.0.4 (semver) 3.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |