Description

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. In versions up to and including 3.0.0, deployments using the shipped default configuration exposed two GraphQL developer features without requiring authentication: the GraphiQL playground, an interactive UI for issuing GraphQL queries; and schema introspection, which lets a caller download the full description of every query, mutation, type, and argument the API supports. Anyone who could reach the `/graphiql` endpoint could open the playground in a browser, pull the full schema, and use that to map out the API and craft calls against it. By itself this does not leak user data, but it removes the guesswork from attacking the rest of the API and significantly lowers the bar for finding and exploiting other weaknesses. Version 3.0.1 patches the issue. As a workaround, override the two settings in deployed configuration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-11T20:17:13.463Z",
  "pubdate": "2026-09-11T20:17:13.463Z",
  "executiveSummary": "NL Portal Backend Libraries versions up to and including 3.0.0 contain a critical configuration vulnerability involving the unintended exposure of administrative GraphQL features.\nThe vulnerability resides in the default deployment configuration, which fails to restrict access to the GraphiQL interactive playground and schema introspection capabilities.\nBy bypassing authentication requirements for these endpoints, the system allows unauthenticated network actors to perform comprehensive API discovery, mapping, and documentation gathering.\nWhile the exposure does not directly leak sensitive user data, it facilitates reconnaissance by revealing the full schema, including all supported mutations, queries, types, and arguments.\nThis significantly lowers the threshold for attackers to identify further vulnerabilities, such as broken object-level authorization (BOLA) or mass assignment, by providing a complete structural map of the backend API.\nThe risk is categorized as high for information disclosure, as it serves as a force multiplier for complex, multi-stage attacks against the backend infrastructure.",
  "technicalDetails": "The root cause of this vulnerability is a permissive default configuration in the NL Portal Backend Libraries that exposes the GraphiQL interface and GraphQL schema introspection without requiring prior authentication.\nGraphQL introspection is a powerful feature intended for developer environments, allowing clients to query the server for its schema—a complete definition of available API operations. When enabled in a production environment without access controls, this feature acts as an automated API blueprint generator.\nAn attacker can exploit this by navigating to the publicly accessible /graphiql endpoint. Upon access, the GraphiQL playground provides an interactive UI that automatically invokes introspection queries against the backend. Even without the UI, a simple GET or POST request containing an introspection query can be used to retrieve the entire API schema in JSON format.\nThe attack flow follows a structured reconnaissance pattern: 1) Identification of the /graphiql endpoint through network scanning or directory brute-forcing. 2) Execution of an introspection query to extract the schema definition. 3) Analysis of the returned types, fields, and arguments to identify private or hidden API endpoints. 4) Crafting of targeted GraphQL mutations or queries that exploit identified, undocumented, or poorly secured backend business logic.\nBecause the schema includes detailed descriptions of mutations—which represent the write/update operations of the API—the attacker gains precise knowledge of how to manipulate server-side data, including parameters required to bypass validation or perform unauthorized state changes.\nThis exposure is present in all versions up to and including 3.0.0. The lack of authentication or authorization checks on these specific endpoints means that any entity with network visibility to the portal can perform these operations.\nPost-exploitation, the attacker possesses a complete 'map' of the application's attack surface. This allows them to bypass the need for tedious manual discovery and focus directly on potential injection points, access control flaws, or business logic vulnerabilities within the backend resolvers, significantly increasing the probability of a successful downstream compromise."
}