GitHub Advisoryadvisory · npm

GHSA-gp6m-x9vw-5c5x Backstage has improper authorization in GitLab organizational user ingestion

MEDIUM Published 2026-10-07 Modified 2026-10-07 Official page ↗
Aliases
CVE-2026-106463
Ecosystem
npm
Packages
@backstage/plugin-catalog-backend-module-gitlab
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-863
Reviewed
2026-10-07

Affected packages

• npm @backstage/plugin-catalog-backend-module-gitlab: < 0.8.7 → fixed in 0.8.7

Description

Impact Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthorized access with the permissions of a standard authenticated user. Patches • Upgrade `@backstage/plugin-catalog-backend-module-gitlab` to version `0.8.7`. Workarounds • Disable event-driven GitLab organization ingestion and rely on scheduled discovery until upgrading. • Enforce organization membership independently at the authenticating proxy or sign-in resolver.

Related

Alias · CVE (1)

  • CVE-2026-106463 Backstage is an open framework for building developer portals. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References