Executive brief
Backstage is an open-source framework used by organizations to build internal developer portals. A security flaw in the catalog module allows any logged-in user to view 'unprocessed entity' records that they should not have permission to see. This could lead to the unauthorized disclosure of internal system metadata or configuration details. Organizations using the affected modules should update to the latest versions to restore proper access controls.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in the @backstage/plugin-catalog-backend-module-unprocessed module. The read endpoints for unprocessed entities do not validate ownership or enforce the Backstage permission framework. As a result, any authenticated user with network access to the backend can retrieve unprocessed entity records regardless of their assigned permissions. The vulnerability is resolved in @backstage/plugin-catalog-backend-module-unprocessed v0.6.11 and its associated common and frontend packages. A temporary workaround involves removing the affected module from the Backstage backend.
Affected products
- Backstage @backstage/plugin-catalog-backend-module-unprocessed < 0.6.11
- Backstage @backstage/plugin-catalog-unprocessed-entities-common < 0.0.15
- Backstage @backstage/plugin-catalog-unprocessed-entities < 0.2.30
Timeline
- 2026-04-29: advisory: GitHub Security Advisory published
- 2026-05-14: disclosed: CVE published to NVD