CVE-2026-106497

Undergoing Analysis Undergoing Analysis - In Progress

Inconsistent Catalog Property Permissions in Backstage

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: GitHub, Inc.

Description

Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent catalog property permission evaluation. In deployments that use affected value-based catalog permission conditions as a confidentiality boundary, an authenticated user could receive catalog entity data that policy authors intended to restrict. This issue is fixed in version 3.9.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-06

Generated

2026-10-08

AI Q&A

2026-10-07

EPSS Evaluated

N/A

NVD

CVE-2026-106497

Affected Vendors & Products

Vendor	Product	Version / Range
backstage	backstage	< 1.54.6
@backstage	plugin-catalog-backend	< 3.9.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-178	The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Backstage is an open framework for building developer portals. The vulnerability in the @backstage/plugin-catalog-backend package before version 3.9.1 allows inconsistent catalog property permission evaluation. This means that when using value-based catalog permission conditions as a confidentiality boundary, an authenticated user could access catalog entity data that was meant to be restricted.

Detection Guidance

To detect this vulnerability, check if your Backstage instance is running a version of @backstage/plugin-catalog-backend prior to 3.9.1. Run the command: npm list @backstage/plugin-catalog-backend to verify the installed version. If the version is below 3.9.1, the system is vulnerable.

Impact Analysis

If you use Backstage with the affected plugin version, an attacker with authenticated access could retrieve sensitive catalog entity data that was intended to be restricted. This could lead to unauthorized exposure of internal information.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, which may violate compliance requirements such as GDPR or HIPAA if sensitive data is leaked. Organizations using affected versions should update to mitigate risks.

Mitigation Strategies

Upgrade the @backstage/plugin-catalog-backend package to version 3.9.1 or later to address the permission evaluation issue.
Review and audit catalog permission conditions to ensure they correctly restrict data access as intended by policy authors.
Apply the latest security patches for Backstage and its plugins to prevent similar issues.

Hi! I’m here to help you understand CVE-2026-106497. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70