---
id: CVE-2026-106495
title: Backstage is an open framework for building developer portals
summary: >-
  Backstage is an open framework for building developer portals. Prior to
  0.17.8, the @backstage/backend-defaults package is affected by improper access
  control in backend action invocation. An authenticated user could invoke
  actions that …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-284
vendor: backstage
product: backstage
affected:
  - backstage < 1.54.6
  - backend-defaults < 0.17.8
patched:
  - '@backstage/backend-defaults 0.17.8'
published: '2026-10-12'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T16:00:33.533'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106495'
references:
  - url: >-
      https://github.com/backstage/backstage/commit/a8fb34a990a69bcb745e85a3213cf9e5ba2d31a3
    label: security-advisories@github.com
  - url: 'https://github.com/backstage/backstage/releases/tag/v1.54.6'
    label: security-advisories@github.com
  - url: >-
      https://github.com/backstage/backstage/security/advisories/GHSA-3xr5-8w6c-p5gw
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106495'
  - url: 'https://github.com/advisories/GHSA-3xr5-8w6c-p5gw'
tags:
  - nvd
  - cve.org
  - ghsa
  - npm
epss: 0.00239
epssPercentile: 0.14846
aliases:
  - GHSA-3xr5-8w6c-p5gw
ecosystem: npm
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-13T14:57:13.322541Z'
ingestedAt: '2026-10-12T22:05:40.352Z'
---

## Overview

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced. This issue is fixed in version 0.17.8.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-106495)

Affected packages:

- `@backstage/backend-defaults < 0.17.8`

Patched in:

- `@backstage/backend-defaults 0.17.8`

Source: https://github.com/advisories/GHSA-3xr5-8w6c-p5gw