GHSA-3XR5-8W6C-P5GW Backstage: Improper access control in backend action invocation

Impact An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced. Patches Patched in @backstage/backend-defaults version 0.17.8 Workarounds Limit access to action invocation...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +307 more potentially affected by CVE-2026-106495 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.17.7)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =1.0.7, =0.1.8, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =1.0.4, =0.1.5, =0.3.6, =2.5.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-106495 Source advisory: GHSA-3XR5-8W6C-P5GW...

Improper Authorization

Overview @backstage/backend-defaults is a Backend defaults used by Backstage backend apps Affected versions of this package are vulnerable to Improper Authorization via the actions registry endpoint /.backstage/actions/v1/actions in DefaultActionsRegistryService, where the isActionAllowed filter...

EUVD-2026-97833

Backstage: Improper access control in backend action invocation...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +307 more potentially affected by CVE-2026-106495 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.17.7)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =1.0.7, =0.1.8, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =1.0.4, =0.1.5, =0.3.6, =2.5.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-106495 Source advisory: OSV:GHSA-3XR5-8W6C-P5GW...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +307 more potentially affected by CVE-2026-106495 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.17.7)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =1.0.7, =0.1.8, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =1.0.4, =0.1.5, =0.3.6, =2.5.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-106495 Source advisory:...

CVE-2026-106495

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration...

CVE-2026-106495 Backstage: Improper access control in backend action invocation

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20260521032220, <=0.8.7-next.0), @backstage/backend-test-utils (>=1.11.3-next.0, <=1.11.6-next.1) +9 more potentially affected by CVE-2026-106495 via @backstage/backend-defaults (>=0.17.1-next.0, <=0.17.7)

@backstage/backend-defaults NPM version =0.17.1-next.0, =0.0.0-nightly-20260521032220, =1.11.3-next.0, =0.0.0-nightly-20260820023416, =0.0.0-nightly-20260826023806, =0.0.0-nightly-20260826023806, =0.0.0-nightly-20260521032220, =0.0.0-nightly-20260521032220, =0.4.22-next.0, =0.3.11-next.0, =8.0.0,...

CVE-2026-106495

The Backstage framework is affected by an improper access control vulnerability in the @backstage/backend-defaults package. Prior to version 0.17.8 , an authenticated user could successfully invoke backend actions that an operator had specifically excluded through action configuration. While exis...

CVE-2026-106495

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration...

CVE-2026-106495 Backstage: Improper access control in backend action invocation

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration...

CVE-2026-106495 Backstage: Improper access control in backend action invocation

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration...

PT-2026-110908

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.17.8 Description The @backstage/backend-defaults package contains improper access control regarding backend action invocation. This allows an authenticated user to trigger actions that an operator specifically...

CVE-2026-106495: Improper Access Control

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration...

Directory Traversal

Overview @backstage/backend-defaults is a Backend defaults used by Backstage backend apps Affected versions of this package are vulnerable to Directory Traversal via the parseUrl functions in AwsS3UrlReader.ts and AzureBlobStorageUrlReader.ts, where URL path segments are not validated for...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +307 more potentially affected by CVE-2026-106493 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.17.7)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =1.0.7, =0.1.8, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =1.0.4, =0.1.5, =0.3.6, =2.5.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-106493 Source advisory: OSV:GHSA-XVH9-35W9-42M4...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +307 more potentially affected by CVE-2026-106493 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.17.7)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =1.0.7, =0.1.8, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =1.0.4, =0.1.5, =0.3.6, =2.5.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-106493 Source advisory: GHSA-XVH9-35W9-42M4...

@alauda/dp-dynamic-plugin-backend-core (>=0.1.11, <=0.1.12), @alithya-oss/backstage-plugin-aws-apps-backend (>=0.4.5, <=0.4.7) +307 more potentially affected by CVE-2026-106493 via @backstage/backend-defaults (>=0.0.0-nightly-20240929023448, <=0.17.7)

@backstage/backend-defaults NPM version =0.0.0-nightly-20240929023448, =0.1.11, =0.4.5, =1.0.0, =2.0.6, =1.0.7, =0.1.8, =0.3.10, =3.0.5, =0.4.1, =2.0.3, =1.0.4, =0.1.5, =0.3.6, =2.5.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-106493 Source advisory:...

@backstage/backend-dynamic-feature-service (>=0.0.0-nightly-20260521032220, <=0.8.7-next.0), @backstage/backend-test-utils (>=1.11.3-next.0, <=1.11.6-next.1) +9 more potentially affected by CVE-2026-106492 via @backstage/backend-defaults (>=0.17.1-next.0, <=0.17.7)

@backstage/backend-defaults NPM version =0.17.1-next.0, =0.0.0-nightly-20260521032220, =1.11.3-next.0, =0.0.0-nightly-20260820023416, =0.0.0-nightly-20260826023806, =0.0.0-nightly-20260826023806, =0.0.0-nightly-20260521032220, =0.0.0-nightly-20260521032220, =0.4.22-next.0, =0.3.11-next.0, =8.0.0,...