CVE-2026-106495

The Backstage framework is affected by an improper access control vulnerability in the @backstage/backend-defaults package. Prior to version 0.17.8 , an authenticated user could successfully invoke backend actions that an operator had specifically excluded through action configuration. While exis...

EUVD-2026-97833

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration...

CVE-2026-41906 FreeScout: Conversation Change-Customer Cross-Mailbox Authorization Bypass

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.214, the Change Customer modal correctly hides out-of-scope customers through the mailbox-filtered search endpoint, but the backend conversationchangecustomer action accepts any supplied...