{"id":"CVE-2026-44374","aliases":["EUVD-2026-30295","GHSA-p7g9-rp3g-mgfg"],"status":"published","title":"Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks","description":"Backstage is an open framework for building developer portals. Prior to 0.6.11, the unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is an information disclosure vulnerability affecting Backstage installations using this module. This is patched in @backstage/plugin-catalog-backend-module-unprocessed version 0.6.11, @backstage/plugin-catalog-unprocessed-entities-common version 0.0.15 and @backstage/plugin-catalog-unprocessed-entities version 0.2.30.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0017,"percentile":0.06449,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-05-06T23:04:07Z","modified":"2026-10-26T14:10:00Z","fixes":[{"ecosystem":"npm","package":"@backstage/plugin-catalog-unprocessed-entities-common","fixed_in":["0.0.15"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@backstage/plugin-catalog-unprocessed-entities","fixed_in":["0.2.30"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@backstage/plugin-catalog-backend-module-unprocessed","fixed_in":["0.6.11"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@backstage/plugin-catalog-unprocessed-entities-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.15"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@backstage/plugin-catalog-unprocessed-entities","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.30"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@backstage/plugin-catalog-backend-module-unprocessed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.11"}]}]},{"source":"osv","ecosystem":"npm","package":"@backstage/plugin-catalog-unprocessed-entities-common","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.15"}]}]},{"source":"osv","ecosystem":"npm","package":"@backstage/plugin-catalog-unprocessed-entities","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.30"}]}]},{"source":"osv","ecosystem":"npm","package":"@backstage/plugin-catalog-backend-module-unprocessed","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.6.11"}]}]}],"products":[{"vendor":"@backstage","product":"plugin-catalog-backend-module-unprocessed"},{"vendor":"@backstage","product":"plugin-catalog-unprocessed-entities"},{"vendor":"@backstage","product":"plugin-catalog-unprocessed-entities-common"},{"vendor":"linuxfoundation","product":"backstage\\/plugin-catalog-backend-module-unprocessed"},{"vendor":"linuxfoundation","product":"backstage\\/plugin-catalog-unprocessed-entities"},{"vendor":"linuxfoundation","product":"backstage\\/plugin-catalog-unprocessed-entities-common"}],"references":[{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-p7g9-rp3g-mgfg","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44374","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p7g9-rp3g-mgfg"},{"url":"https://github.com/backstage/backstage","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-44374","title":"Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks","description":"Backstage is an open framework for building developer portals. Prior to 0.6.11, the unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is an information disclosure vulnerability affecting Backstage installations using this module. This is patched in @backstage/plugin-catalog-backend-module-unprocessed version 0.6.11, @backstage/plugin-catalog-unprocessed-entities-common version 0.0.15 and @backstage/plugin-catalog-unprocessed-entities version 0.2.30.","status":"published","published":"2026-05-14T14:30:04.945Z","modified":"2026-05-14T19:51:53.801Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T13:42:49.132798Z"}],"euvd":[{"id":"EUVD-2026-30295","description":"Backstage is an open framework for building developer portals. Prior to 0.6.11, the unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is an information disclosure vulnerability affecting Backstage installations using this module. This is patched in @backstage/plugin-catalog-backend-module-unprocessed version 0.6.11, @backstage/plugin-catalog-unprocessed-entities-common version 0.0.15 and @backstage/plugin-catalog-unprocessed-entities version 0.2.30.","status":"published","published":"2026-05-14T14:30:04Z","modified":"2026-05-14T19:51:53Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:04:30.595644Z"}],"ghsa":[{"id":"GHSA-p7g9-rp3g-mgfg","title":"Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks","description":"### Impact   \n\n  The unprocessed entities read endpoints in `@backstage/plugin-catalog-backend-module-unprocessed` do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is \n  an information disclosure vulnerability affecting Backstage installations using this module.                                                                     \n                                                                        \n  ### Patches             \n                                         \n  This is patched in `@backstage/plugin-catalog-backend-module-unprocessed` version 0.6.11, `@backstage/plugin-catalog-unprocessed-entities-common` version 0.0.15 and `@backstage/plugin-catalog-unprocessed-entities` version 0.2.30. Users should upgrade all packages.                                    \n   \n  ### Workarounds                                                                                                                                                                                                                                  \n                                                                        \n  If users cannot upgrade, they can remove the `@backstage/plugin-catalog-backend-module-unprocessed` module from their backend until the patch is applied. There is no configuration-based workaround to add permission checks to these endpoints    \n  without upgrading.","status":"published","published":"2026-05-06T23:04:07Z","modified":"2026-05-14T20:49:32Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:40:10.269075Z"}],"nvd":[{"id":"CVE-2026-44374","description":"Backstage is an open framework for building developer portals. Prior to 0.6.11, the unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is an information disclosure vulnerability affecting Backstage installations using this module. This is patched in @backstage/plugin-catalog-backend-module-unprocessed version 0.6.11, @backstage/plugin-catalog-unprocessed-entities-common version 0.0.15 and @backstage/plugin-catalog-unprocessed-entities version 0.2.30.","status":"published","published":"2026-05-14T15:16:48.25Z","modified":"2026-10-26T14:10:00.13Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:19.020465Z"}],"osv":[{"id":"GHSA-p7g9-rp3g-mgfg","title":"Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks","description":"### Impact   \n\n  The unprocessed entities read endpoints in `@backstage/plugin-catalog-backend-module-unprocessed` do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is \n  an information disclosure vulnerability affecting Backstage installations using this module.                                                                     \n                                                                        \n  ### Patches             \n                                         \n  This is patched in `@backstage/plugin-catalog-backend-module-unprocessed` version 0.6.11, `@backstage/plugin-catalog-unprocessed-entities-common` version 0.0.15 and `@backstage/plugin-catalog-unprocessed-entities` version 0.2.30. Users should upgrade all packages.                                    \n   \n  ### Workarounds                                                                                                                                                                                                                                  \n                                                                        \n  If users cannot upgrade, they can remove the `@backstage/plugin-catalog-backend-module-unprocessed` module from their backend until the patch is applied. There is no configuration-based workaround to add permission checks to these endpoints    \n  without upgrading.","status":"published","published":"2026-05-06T23:04:07Z","modified":"2026-05-14T21:03:41.658932Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:52.891208Z"}]}}