CVE-2026-106562Medium· 4.3▾ SunlitBackstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documen…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject to a DENY policy for search document types could receive unauthorized results in deployments with permission.enabled set to true and an Elasticsearch or OpenSearch backend. This issue is fixed in @backstage/plugin-search-backend 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch 1.8.7.
backstage/plugin-search-backend < 2.1.6backstage/plugin-search-backend-module-elasticsearch < 1.8.7backstage < 1.54.1Upgrade past the affected range:
backstage/plugin-search-backend 2.1.6backstage/plugin-search-backend-module-elasticsearch 1.8.7backstage 1.54.1Affected packages:
@backstage/plugin-search-backend < 2.1.6@backstage/plugin-search-backend-module-elasticsearch < 1.8.7Patched in:
@backstage/plugin-search-backend 2.1.6@backstage/plugin-search-backend-module-elasticsearch 1.8.7Connected by shared product, vendor, weakness, or advisory.
CVE-2026-106563Medium· 5.3Backstage is an open framework for building developer portals
CVE-2026-106561Medium· 5.0Backstage is an open framework for building developer portals
CVE-2026-106498High· 7.7Backstage is an open framework for building developer portals
CVE-2026-106496Low· 3.1Backstage is an open framework for building developer portals
CVE-2026-106497Medium· 4.3Backstage is an open framework for building developer portals
CVE-2026-33217High· 7.1NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system