---
id: CVE-2026-55414
title: >-
  NL Portal Backend Libraries provide backend components for Dutch government
  portals that interact with residents, customers, suppliers, and partner
  organizations
summary: >-
  NL Portal Backend Libraries provide backend components for Dutch government
  portals that interact with residents, customers, suppliers, and partner
  organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public
  getFormDefinitionByObject…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-862
  - CWE-918
vendor: nl-portal
product: nl-portal-backend-libraries
affected:
  - 'nl-portal-backend-libraries >= 1.1.0, < 3.0.4'
  - nl-portal-backend-libraries = 3.1.0
patched:
  - 'nl.nl-portal:form 3.0.4'
published: '2026-10-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T20:04:29.760'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55414'
references:
  - url: >-
      https://github.com/nl-portal/nl-portal-backend-libraries/commit/5ea04ef6445443e22e40a23fbed447e618b70c3f
    label: security-advisories@github.com
  - url: 'https://github.com/nl-portal/nl-portal-backend-libraries/pull/700'
    label: security-advisories@github.com
  - url: >-
      https://github.com/nl-portal/nl-portal-backend-libraries/releases/tag/3.0.4.RELEASE
    label: security-advisories@github.com
  - url: >-
      https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-xm3x-9cfw-jhx4
    label: security-advisories@github.com
  - url: >-
      https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-xm3x-9cfw-jhx4
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-xm3x-9cfw-jhx4'
tags:
  - nvd
  - cve.org
  - exploit-available
  - ghsa
  - maven
epss: 0.00437
epssPercentile: 0.37787
ecosystem: maven
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-15T18:25:48.650492Z'
ingestedAt: '2026-06-22T15:59:08.200Z'
---

## Overview

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL resolvers are reachable without CommonGroundAuthentication and forward a caller-influenced URL through ObjectenApiService.getObjectByUrl to ObjectsApiClient.getObjectByUrl, which attaches the privileged Objecten-API token. The host-equality check restricts requests to the configured Objecten-API host but does not constrain the scheme, port, or path, allowing an unauthenticated caller to induce a token-bearing request to a chosen endpoint on that host. Standard deployments are not exposed to cross-host SSRF, token capture requires attacker-controlled routing on the configured host, and typed deserialization limits returned data to objects shaped like form definitions. The 3.0 release line is fixed in version 3.0.4. The advisory does not identify a fixed 3.1 release.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55414)

Affected packages:

- `nl.nl-portal:form >= 1.1.0, < 3.0.4`

Patched in:

- `nl.nl-portal:form 3.0.4`

Source: https://github.com/advisories/GHSA-xm3x-9cfw-jhx4