Incorrect Authorization

Overview @backstage/plugin-catalog-backend-module-gitlab is an A Backstage catalog backend module that helps integrate towards GitLab Affected versions of this package are vulnerable to Incorrect Authorization via the GitlabOrgDiscoveryEntityProvider when handling usercreate webhook events, where...

CVE-2026-106463

A flaw was found in Backstage's plugin-catalog-backend-module-gitlab. When GitLab organization event ingestion is enabled, improper authorization checks during user ingestion can allow unintended identities to be registered in the catalog. A remote attacker may exploit this flaw to bypass catalog...

GitLab 11.7 < 18.8.9 / 18.9 < 18.9.5 / 18.10 < 18.10.3 (CVE-2026-1403)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an...

FreeBSD: VID-099d4998-33cc-11f1-a7d1-2cf05da270f3 (CVE-2026-1403): Gitlab -- vulnerabilities

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file...

CVE-2026-106463

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped...

CVE-2026-92599 vulnerabilities

Vulnerabilities for packages: unleash, gitlab-rails-ce-fips, thingsboard-fips, opensearch-dashboards-fips, thingsboard, opensearch-dashboards...

GHSA-MRX9-2RRP-RHPX vulnerabilities

Vulnerabilities for packages: unleash, gitlab-rails-ce-fips, thingsboard-fips, opensearch-dashboards-fips, thingsboard, opensearch-dashboards...

CVE-2026-106463

The Backstage framework is vulnerable to improper authorization in the @backstage/plugin-catalog-backend-module-gitlab package prior to version 0.8.7 . The flaw occurs during GitLab organizational user ingestion ; deployments enabling GitLab organization event ingestion that rely on scoped catalo...

CVE-2026-106463 Backstage: Improper authorization in GitLab organizational user ingestion

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped...

CVE-2026-106463 Backstage: Improper authorization in GitLab organizational user ingestion

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped...

@backstage/plugin-catalog-backend-module-gitlab-org (>=0.0.0-nightly-20240423021331, <=0.2.25-next.0) potentially affected by CVE-2026-106463 via @backstage/plugin-catalog-backend-module-gitlab (>=0.0.0-nightly-20241224023253, <=0.8.7-next.0)

@backstage/plugin-catalog-backend-module-gitlab NPM version =0.0.0-nightly-20241224023253, =0.0.0-nightly-20240423021331, =0.2.25-next.0 Source cves: CVE-2026-106463 Source advisory: MEND:CVE-2026-106463...

CVE-2026-106463

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped...

CVE-2026-106463 Backstage: Improper authorization in GitLab organizational user ingestion

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped...

@alithya-oss/backstage-plugin-scaffolder-backend-module-aws-apps (>=0.3.10, <=0.3.12), @alithya-oss/plugin-scaffolder-backend-module-aws-apps (>=0.3.6, <=0.3.9) +54 more potentially affected by CVE-2026-106462 via @backstage/plugin-scaffolder-backend-module-gitlab (>=0.0.0-nightly-20240929023448, <=0.11.3-next.2)

@backstage/plugin-scaffolder-backend-module-gitlab NPM version =0.0.0-nightly-20240929023448, =0.3.10, =0.3.6, =0.1.0, =0.4.0, =0.0.0-nightly-20231213021616, =0.2.5, =0.3.5, =0.1.0, =0.2.3, =0.4.3, =0.1.10, =4.3.2, =0.3.3, =0.3.4 and more Source...

BIT-GITLAB-2026-8937 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to read private child issue contents, including titles and descriptions, from projects...

BIT-GITLAB-2026-84739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to...

BIT-GITLAB-2026-4523 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sensitive variable values due to improper...

BIT-GITLAB-2026-10518 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security policy content they were not authoriz...

CVE-2026-106463: Incorrect Authorization

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped...

PT-2026-107266

Name of the Vulnerable Software and Affected Versions @backstage/plugin-catalog-backend-module-gitlab versions prior to 0.8.7 Description Improper authorization exists during GitLab organizational user ingestion. Deployments that enable GitLab organization event ingestion and use scoped catalog...