CVEvulnerability

CVE-2026-106497

4.3 MEDIUM Published 2026-10-06 Modified 2026-10-16 Official page ↗

Status: Analyzed
Published: 2026-10-06
Last modified: 2026-10-16
Assigner: [email protected]
CVSS 3.1 ([email protected]): 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses: CWE-178, CWE-863

Description

Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent catalog property permission evaluation. In deployments that use affected value-based catalog permission conditions as a confidentiality boundary, an authenticated user could receive catalog entity data that policy authors intended to restrict. This issue is fixed in version 3.9.1.

Affected configurations

• linuxfoundation backstage plugin-catalog-backend (< 3.9.1) • linuxfoundation backstage (< 1.54.6)

Weakness · CWE (2)

CWE-178 Improper Handling of Case Sensitivity weakness
CWE-863 Incorrect Authorization weakness

References

https://github.com/backstage/backstage/commit/21424faa2e280a6bc6b9e5c5245952f16aafca7b Patch
https://github.com/backstage/backstage/releases/tag/v1.54.6 Patch, Release Notes
https://github.com/backstage/backstage/security/advisories/GHSA-8429-xpcj-3cg5 Mitigation, Vendor Advisory

CVE-2026-106497

Description

Affected configurations

Related

Weakness · CWE (2)

References