CVE-2026-55414: CWE-862: Missing Authorization in nl-portal nl-portal-backend-libraries

The nl-portal-backend-libraries contain a missing authorization vulnerability (CWE-862) in the public GraphQL resolvers getFormDefinitionByObjectenApiUrl and the deprecated getFormDefinitionById. These resolvers are accessible without CommonGroundAuthentication and forward a caller-influenced URL through ObjectenApiService to ObjectsApiClient, which attaches a privileged Objecten-API token. The host-equality check restricts requests to the configured Objecten-API host but does not restrict scheme, port, or path, allowing an unauthenticated attacker to induce token-bearing requests to arbitrary endpoints on that host. Standard deployments are not vulnerable to cross-host SSRF, and exploitation requires attacker-controlled routing on the configured host. The 3.0 release line is fixed in version 3.0.4, but no fix is identified for 3.1.0.

An unauthenticated attacker can access certain GraphQL resolvers that forward requests with a privileged API token to a configured host. This could allow the attacker to induce token-bearing requests to endpoints on the host, potentially exposing sensitive data shaped like form definitions. There is no impact on integrity or availability, and exploitation requires specific routing conditions. The CVSS score is 5.3 (medium severity) with network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact.

The vulnerability is fixed in nl-portal-backend-libraries version 3.0.4 for the 3.0 release line. Users should upgrade to version 3.0.4 or later within the 3.0 line to remediate this issue. No fix is identified for version 3.1.0 in the advisory; users of this version should consult the vendor for updated guidance. Until patched, restrict access to the affected GraphQL resolvers and ensure proper authentication is enforced.