The public GraphQL resolvers "getFormDefinitionByObjectenApiUrl(url)" and the deprecated "getFormDefinitionById(id)" fetch a caller-supplied URL using the privileged Objecten-API token. Because the "/graphql" endpoint is "permitAll()" and these resolvers do not declare a "CommonGroundAuthentication" parameter, an unauthenticated caller can make the backend issue an outbound request carrying "Authorization: Token <objecten-api-token>" to a caller-influenced URL on the configured Objecten-API host. This is a constrained (same-host) server-side request forgery combined with missing authorization. Reported responsibly and confirmed in a local lab build against the project's own WebFlux security stack. No production system was accessed.