GHSA-3JPJ-V3XR-5H6G zrok: Broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records

Summary The unaccess handler controller/unaccess.go contains a logical error in its ownership guard: when a frontend record has environmentid = NULL the marker for admin-created global frontends, the condition short-circuits to false and allows the deletion to proceed without any ownership...

PT-2026-21899

Name of the Vulnerable Software and Affected Versions Red Hat Developer Hub Backstage Orchestrator Plugin affected versions not specified Description A security flaw exists due to insufficient input validation in GraphQL query handling. An authenticated user can inject specially crafted input int...