CVE-2026-106562 Backstage: Incorrect authorization in search engine permission filtering
Authenticated users can bypass search document denial policies to view unauthorized results in Backstage deployments using Elasticsearch or OpenSearch.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-106562?
CVE-2026-106562 is a medium-severity missing authorization vulnerability in Linuxfoundation Backstage, published on 7 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject to a DENY policy for search document types could receive unauthorized results in deployments with permission.enabled set to true and an Elasticsearch or OpenSearch backend. This issue is fixed in @backstage/plugin-search-backend 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch 1.8.7.
Which versions are affected by CVE-2026-106562?
4 open source packages ship an affected version, including @backstage/plugin-search-backend and @backstage/plugin-search-backend-module-elasticsearch. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
@backstage/plugin-search-backend npm | All versions | 2.1.6 |
@backstage/plugin-search-backend npm | All versions | 2.1.6 |
@backstage/plugin-search-backend-module-elasticsearch npm | All versions | 1.8.7 |
@backstage/plugin-search-backend-module-elasticsearch npm | All versions | 1.8.7 |
Products include Linuxfoundation Backstage, Linuxfoundation Backstage\/Plugin-Search-Backend, Linuxfoundation Backstage\/Plugin-Search-Backend-Module-Elasticsearch.
How do I fix CVE-2026-106562?
Upgrade @backstage/plugin-search-backend to 2.1.6 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-106562 being exploited?
There is no known exploitation of CVE-2026-106562 in the wild and no public exploit code.
Other vulnerabilities in Linuxfoundation Backstage
- CVE-2026-106501 Backstage: Sensitive information exposure in Scaffolder
- CVE-2026-106558 Backstage: Improper validation of TechDocs MkDocs configuration
- CVE-2026-88064 Backstage: Improper input validation in TechDocs MkDocs configuration
- CVE-2026-106459 Backstage: Improper input validation in Sentry scaffolder actions
- CVE-2026-106486 Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions
Sources
Also known as GHSA-9325-vq29-gp3v.