CVE-2026-112068

The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site...

CVE-2026-112064

The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics...

EUVD-2026-104874

The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics...

EUVD-2026-104871

The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site...

PT-2026-118301

The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics...

PT-2026-118305

The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site...

CVE-2026-106488

A flaw was found in plugin-auth-backend-module-oidc-provider. In deployments using email-based identity resolution with an OpenID Connect OIDC provider that allows unverified email addresses, an authenticated attacker can achieve privilege escalation by assuming another catalog identity. This...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20250225023230, <=0.24.5), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20250225023230, <=0.4.2) +2 more potentially affected by CVE-2026-106457 via @backstage/plugin-auth-backend-module-cloudflare-access-provider (>=0.1.6-next.2, <=0.4.18)

@backstage/plugin-auth-backend-module-cloudflare-access-provider NPM version =0.1.6-next.2, =0.0.0-nightly-20250225023230, =0.0.0-nightly-20250225023230, =0.0.0-nightly-20250225023230, =0.4.2 - @jiteshy/backstage-plugin-synergy-backend 1.2.2 Source cves: CVE-2026-106457 Source advisory:...

Backstage: Insufficient audience validation in the Cloudflare Access auth provider

Impact The Cloudflare Access auth provider verifies a token's signature and team issuer, but affected versions do not verify that the token was issued for the Backstage application. A user holding a valid token for another Access application in the same Cloudflare Zero Trust team may therefore be...

EUVD-2026-93990

Backstage: Insufficient audience validation in the Cloudflare Access auth provider...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20250225023230, <=0.24.5), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20250225023230, <=0.4.2) +2 more potentially affected by CVE-2026-106457 via @backstage/plugin-auth-backend-module-cloudflare-access-provider (>=0.1.6-next.2, <=0.4.18)

@backstage/plugin-auth-backend-module-cloudflare-access-provider NPM version =0.1.6-next.2, =0.0.0-nightly-20250225023230, =0.0.0-nightly-20250225023230, =0.0.0-nightly-20250225023230, =0.4.2 - @jiteshy/backstage-plugin-synergy-backend 1.2.2 Source cves: CVE-2026-106457 Source advisory:...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260822023239, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260827035829, <=2.2.3-next.1) +1 more potentially affected by CVE-2026-106455 via @backstage/plugin-techdocs-node (>=1.15.1-next.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.15.1-next.0, =0.0.0-nightly-20260822023239, =0.0.0-nightly-20260827035829, =0.0.0-nightly-20260823023807, =1.11.4-next.0 Source cves: CVE-2026-106455 Source advisory: OSV:GHSA-Q38J-6VCM-2F5M...

EUVD-2026-93992

Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates...

GHSA-G734-FHP4-7MFP Backstage: Improper input validation in Sentry scaffolder actions

Impact An authenticated internal user who can execute the affected actions may cause the backend to contact unintended destinations and disclose Sentry integration credentials. Subsequent impact depends on network reachability and the privileges granted to the configured token. Patches Upgrade...

EUVD-2026-93993

Backstage: Improper input validation in Sentry scaffolder actions...

@backstage/plugin-search-backend-module-techdocs (>=0.0.0-nightly-20260415031804, <=0.4.18-next.0), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.2.3-next.1) +2 more potentially affected by CVE-2026-106510 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.15.3)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.0.0-nightly-20260415031804, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.11.4-next.0 Source cves: CVE-2026-106510 Source advisory: GHSA-4488-J8VJ-VQQV...

External Control of File Name or Path

Overview @backstage/plugin-scaffolder-backend-module-confluence-to-markdown is a The confluence-to-markdown module for @backstage/plugin-scaffolder-backend Affected versions of this package are vulnerable to External Control of File Name or Path via the getAndWriteAttachments function in...

GHSA-2CMG-V53W-8XFP Backstage: Improper repository path validation in a Scaffolder backend module

Impact An authenticated user who can execute an affected template and control its repository file location may cause generated content to be written outside the task workspace, within locations writable by the Backstage backend process. Patches Patched in...

Backstage: Improper repository path validation in a Scaffolder backend module

Impact An authenticated user who can execute an affected template and control its repository file location may cause generated content to be written outside the task workspace, within locations writable by the Backstage backend process. Patches Patched in...

Directory Traversal

Overview @backstage/plugin-scaffolder-backend-module-confluence-to-markdown is a The confluence-to-markdown module for @backstage/plugin-scaffolder-backend Affected versions of this package are vulnerable to Directory Traversal via parsedRepoUrl.filepath in confluenceToMarkdown.ts, where...