CVE-2026-44374: Incorrect Authorization

Backstage is an open framework for building developer portals. Prior to 0.6.11, the unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless o...

@janus-idp/backstage-plugin-keycloak-backend (1.0.0) potentially affected by CVE-2023-25571 via @backstage/plugin-catalog-backend (1.5.1)

@backstage/plugin-catalog-backend NPM version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-catalog-backend and may be impacted: - @janus-idp/backstage-plugin-keycloak-backend 1.0.0 Source cves: CVE-2023-25571 Source advisory:...