CVE-2026-106463

medium

Backstage is an open framework for building developer portals.

Vendor / product: Linuxfoundation — backstage\/plugin-catalog-backend-module-gitlab

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthorized access with the permissions of a standard authenticated user. This issue is fixed in version 0.8.7.

CVSS

5.4

5.4 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Severity source: NVD CVSS v3.1 (security-advisories@github.com)

Timeline (UTC)

Published: 2026-10-06 21:17

Modified: 2026-10-22 18:52

NVD status: Analyzed

Last synced 2 days ago

Verified against the source API 2026-10-27 06:58 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

linuxfoundation / backstage\/plugin-catalog-backend-module-gitlab <0.8.7

linuxfoundation / backstage <1.54.6

Weakness classification (CWE)

CWE-863

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://github.com/backstage/backstage/security/advisories/GHSA-gp6m-x9vw-5c5x

Patch / mitigation: https://github.com/backstage/backstage/commit/c211b4b67d28efd2f4fac63e35e2ac515e305cb3

Patch / mitigation: https://github.com/backstage/backstage/releases/tag/v1.54.6

Patch / mitigation: https://github.com/backstage/backstage/security/advisories/GHSA-gp6m-x9vw-5c5x

References

https://github.com/backstage/backstage/commit/c211b4b67d28efd2f4fac63e35e2ac515e305cb3 security-advisories@github.com
https://github.com/backstage/backstage/releases/tag/v1.54.6 security-advisories@github.com
https://github.com/backstage/backstage/security/advisories/GHSA-gp6m-x9vw-5c5x security-advisories@github.com

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 06:58 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2026-106463

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs