CVE-2026-106497 Backstage: Inconsistent catalog property permission evaluation

Medium 4.3 Published 6 Oct 2026 Updated 7 Oct 2026

Authenticated users may access restricted catalog entity data due to inconsistent permission evaluation in Backstage deployments using specific confidentiality boundaries.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-106497?

CVE-2026-106497 is a medium-severity missing authorization vulnerability in Linuxfoundation Backstage, published on 6 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent catalog property permission evaluation. In deployments that use affected value-based catalog permission conditions as a confidentiality boundary, an authenticated user could receive catalog entity data that policy authors intended to restrict. This issue is fixed in version 3.9.1.

Weakness: CWE-863, CWE-178

Which versions are affected by CVE-2026-106497?

It affects 2 products.

Products include Linuxfoundation Backstage, Linuxfoundation Backstage Plugin-Catalog-Backend.

How do I fix CVE-2026-106497?

No fix has been published for CVE-2026-106497 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-106497 being exploited?

There is no known exploitation of CVE-2026-106497 in the wild and no public exploit code.

All Linuxfoundation Backstage vulnerabilities

Sources

Also known as GHSA-8429-xpcj-3cg5.