PT-2026-107281 · Backstage · Backstage

CVE-2026-106497

·

Published

2026-10-06

·

Updated

2026-10-06

CVSS v3.1

4.3

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions Backstage versions prior to 3.9.1
Description The @backstage/plugin-catalog-backend package contains an issue regarding inconsistent catalog property permission evaluation. In environments where value-based catalog permission conditions are used as a confidentiality boundary, an authenticated user may be able to access catalog entity data that was intended to be restricted by policy authors.
Recommendations Update to version 3.9.1.

Exploit

Fix

Incorrect Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-178CWE-863

Related Identifiers

CVE-2026-106497
GHSA-8429-XPCJ-3CG5

Affected Products

Backstage