# CVE-2026-106562: Backstage incorrect authorization in search engine permission filtering

Source: https://junglewise.ai/threats/cve-2026-106562-backstage-has-incorrect-authorization-in-search-engine  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-07. Updated: 2026-10-07  
License: CC BY 4.0 with a link back

CVE-2026-106562 · Severity: medium · CVSS 4.3 · Published 2026-10-07

Backstage is an open-source developer platform that includes a search feature for discovering documentation and services. When permission controls are enabled, an authenticated user denied access to certain search results could still view them due to a flaw in how the search backend filters results. This allows unauthorized disclosure of information that should have been restricted by access policies.

Technologies: [Linuxfoundation Backstage\](https://junglewise.ai/threats/technologies/backstage). Vendors: [Backstage](https://junglewise.ai/threats/vendors/backstage), [Linuxfoundation](https://junglewise.ai/threats/vendors/linuxfoundation), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-106562 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106562 being exploited in the wild.

**How severe is CVE-2026-106562?** Medium severity, with a CVSS score of 4.3, published 7 October 2026.

**Which products and versions are affected?** Backstage Plugin-Search-Backend < 2.1.6; Backstage Plugin-Search-Backend-Module-Elasticsearch < 1.8.7; @backstage/plugin-search-backend (npm) < 2.1.6, SEMVER:introduced=0,fixed=2.1.6; @backstage/plugin-search-backend-module-elasticsearch (npm) < 1.8.7, SEMVER:introduced=0,fixed=1.8.7.

**Is there a fix for CVE-2026-106562?** Yes. @backstage/plugin-search-backend (npm): upgrade to 2.1.6 or later; @backstage/plugin-search-backend-module-elasticsearch (npm): upgrade to 1.8.7 or later. Until then: Temporarily modify permission policies to use CONDITIONAL decisions with per-result filtering rather than blanket DENY for search document types. Additionally, restrict Elasticsearch/OpenSearch index access at the cluster level so the search service account can only reach expected Backstage indices, limiting the blast radius if the authorization bypass is triggered. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106562 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-106562?** Check whether you run Backstage Plugin-Search-Backend, Backstage Plugin-Search-Backend-Module-Elasticsearch, Linuxfoundation Backstage\ or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @backstage/plugin-search-backend (npm): upgrade to 2.1.6 or later

  ```sh
  npm install @backstage/plugin-search-backend@2.1.6
  ```

- @backstage/plugin-search-backend-module-elasticsearch (npm): upgrade to 1.8.7 or later

  ```sh
  npm install @backstage/plugin-search-backend-module-elasticsearch@1.8.7
  ```


Temporarily modify permission policies to use CONDITIONAL decisions with per-result filtering rather than blanket DENY for search document types. Additionally, restrict Elasticsearch/OpenSearch index access at the cluster level so the search service account can only reach expected Backstage indices, limiting the blast radius if the authorization bypass is triggered.

## Technical details

The search backend has an incorrect authorization check (CWE-863) that fails to properly enforce DENY policies when filtering search results from Elasticsearch or OpenSearch backends. An authenticated attacker with low privileges can bypass search result filtering to view documents they are explicitly denied access to. The vulnerability requires permission.enabled: true and an Elasticsearch or OpenSearch search engine to be present in the deployment.

## Affected products

- Backstage plugin-search-backend < 2.1.6
- Backstage plugin-search-backend-module-elasticsearch < 1.8.7

## Identifiers

- CVE-2026-106562
- GHSA-9325-vq29-gp3v

## Timeline

- 2026-08-28: disclosed
- 2026-10-07: advisory

## References

- [https://github.com/backstage/backstage/security/advisories/GHSA-9325-vq29-gp3v](https://github.com/backstage/backstage/security/advisories/GHSA-9325-vq29-gp3v)

## Related threats

- [Backstage improper entity validation in Kubernetes services endpoint](https://junglewise.ai/threats/cve-2026-106563-backstage-improper-entity-validation-in-deprecated-kubernetes)
- [Backstage Kubernetes plugin sensitive information disclosure in resource queries](https://junglewise.ai/threats/cve-2026-106561-backstage-has-a-sensitive-information-disclosure-in-kubernetes)
- [Backstage plugin-scaffolder-backend-module-confluence-to-markdown path traversal](https://junglewise.ai/threats/cve-2026-106560-backstage-improper-repository-path-validation-in-a-scaffolder)
- [Backstage Confluence to Markdown scaffolder input validation bypass](https://junglewise.ai/threats/cve-2026-106559-backstage-improper-input-validation-in-confluence-to-markdown)
- [Backstage plugin-auth-backend OAuth redirect_uri allowlist bypass](https://junglewise.ai/threats/cve-2026-73563-backstage-plugin-auth-backend-oauth-redirect-uri-allowlist-bypass)