CVE-2026-106497

A flaw was found in Backstage's plugin-catalog-backend component. Inconsistent evaluation of catalog property permissions can lead to unauthorized information disclosure. In environments that rely on value-based permission rules to enforce access controls, an authenticated attacker can bypass...