CVE-2026-106495

Received Received - Intake

Improper Access Control in Backstage Backend Defaults

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced. This issue is fixed in version 0.17.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-106495

EUVD

EUVD-2026-97833

Affected Vendors & Products

Vendor	Product	Version / Range
backstage	backstage	< 1.54.6
@backstage	backend-defaults	< 0.17.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

Backstage versions before 0.17.8 have an improper access control flaw in the @backstage/backend-defaults package. Authenticated users can invoke backend actions that were explicitly excluded by the operator through configuration. Existing permissions and authorization checks still apply.

Detection Guidance

To detect this vulnerability, check the version of the @backstage/backend-defaults package in your Backstage installation. If it is below 0.17.8, the system is vulnerable. Run: npm list @backstage/backend-defaults or check package.json for the installed version.

Impact Analysis

An attacker with valid credentials could perform unauthorized actions on the Backstage instance, potentially leading to unintended system behavior or data exposure. The impact is limited since existing permissions and authorization remain enforced.

Compliance Impact

This vulnerability may pose compliance risks by allowing unauthorized actions that could lead to data breaches or improper access. Organizations must ensure proper access controls are in place to meet GDPR, HIPAA, and other regulatory requirements.

Mitigation Strategies

Upgrade the @backstage/backend-defaults package to version 0.17.8 or later. This can be done using npm install @backstage/backend-defaults@0.17.8 or updating the package.json file and running npm install.

Hi! I’m here to help you understand CVE-2026-106495. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70