p PatchFirst

PatchFirst · Latest vulnerabilities

@backstage/plugin-catalog-unprocessed-entities vulnerabilities

Vulnerabilities published for @backstage/plugin-catalog-unprocessed-entities in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. CVE-2026-44374

    Medium · CVSS 4.3EPSS 0.17%Fix available

    Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks

    Backstage is an open framework for building developer portals. Prior to 0.6.11, the unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is an information disclosure vulnerability affecting Backstage installations using this module. This is patched in @backstage/plugin-catalog-backend-module-unprocessed version 0.6.11, @backstage/plugin-catalog-unprocessed-entities-common version 0.0.15 and @backstage/plugin-catalog-unprocessed-entities version 0.2.30.

    @backstage/plugin-catalog-unprocessed-entitiesNode.js
    • Update to 0.2.30
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →