Impact

An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user.

Patches

Patched in @backstage/plugin-catalog-backend version 3.9.1

Workarounds

If you're not able to update immediately:

- Limit the scope of integration credentials (e.g., GitHub tokens) to only the repositories that Backstage needs to access.

Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent catalog property permission evaluation. In deployments that use affected value-based catalog permission conditions as a confidentiality boundary, an authenticated user could receive catalog entity data that policy authors intended to restrict. This issue is fixed in version 3.9.1.

Impact

Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host.

Patches

Patched in @backstage/plugin-catalog-backend version 3.9.1

Workarounds

No practical workarounds are available. Upgrade to the patched version.