CVE-2026-106497Medium· 4.3▾ SunlitBackstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent catalog property permission evaluation. In deployments that use affected value-based…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent catalog property permission evaluation. In deployments that use affected value-based catalog permission conditions as a confidentiality boundary, an authenticated user could receive catalog entity data that policy authors intended to restrict. This issue is fixed in version 3.9.1.
backstage_plugin-catalog-backend < 3.9.1backstage < 1.54.6Upgrade past the affected range:
backstage_plugin-catalog-backend 3.9.1backstage 1.54.6Connected by shared product, vendor, weakness, or advisory.
CVE-2026-106498High· 7.7Backstage is an open framework for building developer portals
CVE-2026-106496Low· 3.1Backstage is an open framework for building developer portals
CVE-2026-106503High· 8.1Backstage is an open framework for building developer portals
CVE-2026-106562Medium· 4.3Backstage is an open framework for building developer portals
CVE-2026-106561Medium· 5.0Backstage is an open framework for building developer portals
CVE-2026-106560High· 7.1Backstage is an open framework for building developer portals