Vulnerability · Published Oct 7, 2026 · Assigned by GitHub_M
CVE-2026-106562Backstage: Incorrect authorization in search engine permission filtering
Medium 4.3
In plain English
A medium-severity incorrect authorization in backstage from backstage. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject to a DENY policy for search document types could receive unauthorized results in deployments with permission.enabled set to true and an Elasticsearch or OpenSearch backend. This issue is fixed in @backstage/plugin-search-backend 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch 1.8.7.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @backstage/plugin-search-backend | 2.1.6 | GHSA-9325-vq29-gp3v |
| npm | @backstage/plugin-search-backend-module-elasticsearch | 1.8.7 | GHSA-9325-vq29-gp3v |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| backstage | backstage | < 1.54.1 |
| @backstage | plugin-search-backend | < 2.1.6 |
| @backstage | plugin-search-backend-module-elasticsearch | < 1.8.7 |
Weakness: CWE-754, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N