CVE-2026-44374
CVE-2026-44374 · Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Backstage is an open framework for building developer portals. Prior to 0.6.11, the unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is an information disclosure vulnerability affecting Backstage installations using this module. This is patched in @backstage/plugin-catalog-backend-module-unprocessed version 0.6.11, @backstage/plugin-catalog-unprocessed-entities-common version 0.0.15 and @backstage/plugin-catalog-unprocessed-entities version 0.2.30.
CVSS 4.3 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
plugin-catalog-backend-module-unprocessed
- Versions
- < 0.6.11: Affected
No fix published
plugin-catalog-unprocessed-entities
- Versions
- < 0.2.30: Affected
No fix published
plugin-catalog-unprocessed-entities-common
- Versions
- < 0.0.15: Affected
No fix published
@backstage/plugin-catalog-unprocessed-entities-common npm
- Affected ranges
- SEMVER: < 0.0.15
Update to 0.0.15
@backstage/plugin-catalog-unprocessed-entities npm
- Affected ranges
- SEMVER: < 0.2.30
Update to 0.2.30
@backstage/plugin-catalog-backend-module-unprocessed npm
- Affected ranges
- SEMVER: < 0.6.11
Update to 0.6.11