CVE-2026-106497 in Backstage
Zusammenfassung
von MITRE • 07.10.2026
Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent catalog property permission evaluation. In deployments that use affected value-based catalog permission conditions as a confidentiality boundary, an authenticated user could receive catalog entity data that policy authors intended to restrict. This issue is fixed in version 3.9.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.