Vulnerability · Published Oct 12, 2026 · Assigned by GitHub_M

CVE-2026-106495Backstage: Improper access control in backend action invocation

Medium 4.3

In plain English

A medium-severity improper access control in backend-defaults from @backstage. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 85.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced. This issue is fixed in version 0.17.8.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@backstage/backend-defaults	0.17.8	GHSA-3xr5-8w6c-p5gw

Affected products (as reported)

Vendor	Product	Versions
backstage	backstage	< 1.54.6
@backstage	backend-defaults	< 0.17.8

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/backstage/backstage/security/advisories/GHSA-3xr5-8w6c-p5gw x_refsource_CONFIRM
https://github.com/backstage/backstage/commit/a8fb34a990a69bcb745e85a3213cf9e5ba2d31a3 x_refsource_MISC
https://github.com/backstage/backstage/releases/tag/v1.54.6 x_refsource_MISC