CVE-2026-106495: Backstage: Improper access control in backend action invocation
Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced. This issue is fixed in version 0.17.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@backstage/backend-defaultsto a version that resolves this vulnerability.Fixed in 0.17.8
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user can exploit it. The issue affects installations using @backstage/backend-defaults before version 0.17.8 where an operator has excluded backend actions through action configuration.
Does exploiting this bypass all authorization controls?
No. Existing action permissions and downstream authorization continue to be enforced, even if an excluded action can be invoked.
What is the remediation?
Upgrade @backstage/backend-defaults to version 0.17.8 or later.