CVEvulnerability

CVE-2026-106492

6.5 MEDIUM Published 2026-10-06 Modified 2026-10-22 Official page ↗
Status
Analyzed
Published
2026-10-06
Last modified
2026-10-22
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-269, CWE-863

Description

Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for. This issue is fixed in versions 0.16.1 and 0.17.8.

Affected configurations

• linuxfoundation backstage\/backend-defaults (< 0.16.1) • linuxfoundation backstage\/backend-defaults (>= 0.17.0 < 0.17.8) • linuxfoundation backstage (< 1.49.6) • linuxfoundation backstage (>= 1.50.0 < 1.54.6)

Related

Weakness · CWE (2)

  • CWE-269 Improper Privilege Management weakness
  • CWE-863 Incorrect Authorization weakness

References