CVE-2026-106562

Katalog CVE

CVSS 4.3 · Medium EPSS 0,20%

Kerentanan Improper Check for Unusual or Exceptional Conditions. Skor CVSS 3.1 4.3 (Medium) menurut github.com.

Deskripsi (NVD)

Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject to a DENY policy for search document types could receive unauthorized results in deployments with permission.enabled set to true and an Elasticsearch or OpenSearch backend. This issue is fixed in @backstage/plugin-search-backend 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch 1.8.7.

Rincian

Terbit di NVD

7 Oktober 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Undergoing Analysis

CVSS 3.1

4.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-754: Improper Check for Unusual or Exceptional Conditions
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 8,7% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/backstage/backstage/commit/2d5d3e77d630455d6d48cfa8f31fd3c126fd6f29
• https://github.com/backstage/backstage/releases/tag/v1.54.1
• https://github.com/backstage/backstage/security/advisories/GHSA-9325-vq29-gp3v