CVE-2026-44374
MEDIUMBackstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks
Title source: cnaDescription
Backstage is an open framework for building developer portals. Prior to 0.6.11, the unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is an information disclosure vulnerability affecting Backstage installations using this module. This is patched in @backstage/plugin-catalog-backend-module-unprocessed version 0.6.11, @backstage/plugin-catalog-unprocessed-entities-common version 0.0.15 and @backstage/plugin-catalog-unprocessed-entities version 0.2.30.
References (1)
Core 1
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/backstage/backstage/security/advisories/GHSA-p7g9-rp3g-mgfg
Scores
CVSS v3
4.3
EPSS
0.0016
EPSS Percentile
6.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-863
Status
published
Products (9)
@backstage/plugin-catalog-backend-module-unprocessed
< 0.6.11
@backstage/plugin-catalog-unprocessed-entities
< 0.2.30
@backstage/plugin-catalog-unprocessed-entities-common
< 0.0.15
backstage/plugin-catalog-backend-module-unprocessed
0 - 0.6.11npm
backstage/plugin-catalog-unprocessed-entities
0 - 0.2.30npm
backstage/plugin-catalog-unprocessed-entities-common
0 - 0.0.15npm
linuxfoundation/backstage\/plugin-catalog-backend-module-unprocessed
< 0.6.11
linuxfoundation/backstage\/plugin-catalog-unprocessed-entities
< 0.2.30
linuxfoundation/backstage\/plugin-catalog-unprocessed-entities-common
< 0.0.15
Published
May 14, 2026
Tracked Since
May 14, 2026