CVE-2026-106495

CVSS 4.3 (medium) · published 2026-10-12

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced. This issue is fixed in version 0.17.8.

Weakness: CWE-284

Source: NVD CVE-2026-106495

References

• https://github.com/backstage/backstage/commit/a8fb34a990a69bcb745e85a3213cf9e5ba2d31a3
• https://github.com/backstage/backstage/releases/tag/v1.54.6
• https://github.com/backstage/backstage/security/advisories/GHSA-3xr5-8w6c-p5gw

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.