CVE-2026-106497: Backstage: Inconsistent catalog property permission evaluation
Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent catalog property permission evaluation. In deployments that use affected value-based catalog permission conditions as a confidentiality boundary, an authenticated user could receive catalog entity data that policy authors intended to restrict. This issue is fixed in version 3.9.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@backstage/plugin-catalog-backendto a version that resolves this vulnerability.Fixed in 3.9.1
Event History
Frequently Asked Questions
Which deployments are meaningfully exposed?
Deployments using @backstage/plugin-catalog-backend before 3.9.1 are exposed if they rely on affected value-based catalog permission conditions to keep catalog entity properties confidential. The issue affects authenticated users rather than unauthenticated access.
What access does an attacker need?
An attacker needs authenticated access to the affected Backstage deployment. No user interaction is required, and the attack complexity is low.
What could an attacker obtain?
An authenticated user could receive catalog entity data that policy authors intended to restrict. The provided severity vector indicates confidentiality impact only; no integrity or availability impact is specified.
What is the remediation?
Upgrade @backstage/plugin-catalog-backend to version 3.9.1 or later. If upgrading cannot happen immediately, review whether affected value-based catalog permission conditions are being used as a confidentiality boundary and avoid relying on them for sensitive catalog properties.