GitHub Advisoryadvisory · npm

GHSA-3xr5-8w6c-p5gw Backstage: Improper access control in backend action invocation

MEDIUM Published 2026-10-15 Modified 2026-10-15 Official page ↗
Aliases
CVE-2026-106495
Ecosystem
npm
Packages
@backstage/backend-defaults
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-284
Reviewed
2026-10-15

Affected packages

• npm @backstage/backend-defaults: < 0.17.8 → fixed in 0.17.8

Description

Impact An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced. Patches Patched in `@backstage/backend-defaults` version `0.17.8` Workarounds Limit access to action invocation endpoints to trusted service callers until upgrading.

Related

Alias · CVE (1)

  • CVE-2026-106495 Backstage is an open framework for building developer portals. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References