CVE-2026-106463

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthorized access with the permissions of a standard authenticated user. This issue is fixed in version 0.8.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106463

EUVD

EUVD-2026-94000

Affected Vendors & Products

Vendor	Product	Version / Range
backstage	backstage	< 1.54.6
@backstage	plugin-catalog-backend-module-gitlab	< 0.8.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Backstage is an open framework for building developer portals. The @backstage/plugin-catalog-backend-module-gitlab package before version 0.8.7 has an improper authorization issue in GitLab organizational user ingestion. This allows unintended catalog identities to be admitted when GitLab organization event ingestion is enabled and scoped catalog users are used as an access boundary.

Detection Guidance

To detect this vulnerability, check if your Backstage deployment uses the @backstage/plugin-catalog-backend-module-gitlab package version before 0.8.7. Verify if GitLab organization event ingestion is enabled and if scoped catalog users are used as an access boundary. Inspect logs for unintended catalog identity admissions or unauthorized access attempts.

Impact Analysis

This vulnerability may allow unauthorized access with the permissions of a standard authenticated user. It depends on sign-in and permission configuration but could lead to unintended access to resources or data within the Backstage portal.

Compliance Impact

This vulnerability may lead to unauthorized access with standard user permissions, potentially violating data protection requirements under GDPR or HIPAA if sensitive data is exposed. However, the specific impact depends on deployment configurations and data handling practices.

Mitigation Strategies

Upgrade the @backstage/plugin-catalog-backend-module-gitlab package to version 0.8.7 or later to address the improper authorization issue in GitLab organizational user ingestion.

Hi! I’m here to help you understand CVE-2026-106463. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70