CVE-2026-44374 Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks

Backstage is an open framework for building developer portals. Prior to 0.6.11, the unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless o...

CVE-2026-44374 Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks

Backstage is an open framework for building developer portals. Prior to 0.6.11, the unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless o...

CVE-2024-53983 Server-side request forgery in Backstage Scaffolder plugin

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

@janus-idp/backstage-plugin-keycloak-backend (1.0.0), @janus-idp/backstage-plugin-quay (>=1.0.0, <=1.2.1) +2 more potentially affected by CVE-2023-25571 via @backstage/catalog-model (>=1.0.0, <=1.1.5)

@backstage/catalog-model NPM version =1.0.0, =1.0.0, =1.2.6, =1.2.7 Source cves: CVE-2023-25571 Source advisory: GHSA-7HV8-3FR9-J2HV...

@backstage/backend-app-api (>=0.0.0-nightly-20220923030237, <=0.0.0-nightly-20260928023907), @backstage/backend-common (>=0.0.0-nightly-20230104022659, <=0.0.0-nightly-20240917021806) +292 more potentially affected by CVE-2023-25571 via @backstage/catalog-model (>=0.0.0-nightly-20220708025041, <=1.1.5)

@backstage/catalog-model NPM version =0.0.0-nightly-20220708025041, =0.0.0-nightly-20220923030237, =0.0.0-nightly-20230104022659, =0.0.0-nightly-20220923030237, =0.0.0-nightly-20240116021644, =0.0.0-nightly-20231025021459, =0.0.0-nightly-20220923030237, =0.0.0-nightly-2021101322257,...

CVE-2023-25571

Backstage is an open platform for building developer portals. "@backstage/catalog-model" prior to version 1.2.0, "@backstage/core-components" prior to 0.12.4, and "@backstage/plugin-catalog-backend" prior to 1.7.2 are affected by a cross-site scripting vulnerability. This vulnerability allows a...

CVE-2023-25571: Improper Neutralization of Encoded URI Schemes in a Web Page

Backstage is an open platform for building developer portals. @backstage/catalog-model prior to version 1.2.0, @backstage/core-components prior to 0.12.4, and @backstage/plugin-catalog-backend prior to 1.7.2 are affected by a cross-site scripting vulnerability. This vulnerability allows a malicio...

PT-2023-20170 · Unknown · @Backstage/Plugin-Catalog-Backend +2

Name of the Vulnerable Software and Affected Versions: @backstage/catalog-model versions prior to 1.2.0 @backstage/core-components versions prior to 0.12.4 @backstage/plugin-catalog-backend versions prior to 1.7.2 Description: This issue allows a malicious actor with access to add or modify conte...

GHSA-PVV8-8FX9-H673 Path Traversal in @backstage/plugin-scaffolder-backend

Impact A malicious actor could read sensitive files from the environment where Scaffolder tasks are run. The attack is executed by crafting a custom Scaffolder template with a publish:github:pull-request action using a particular source path. When the template is executed the sensitive files woul...

Path Traversal in @backstage/plugin-scaffolder-backend

Impact A malicious actor could read sensitive files from the environment where Scaffolder tasks are run. The attack is executed by crafting a custom Scaffolder template with a publish:github:pull-request action using a particular source path. When the template is executed the sensitive files woul...