CVE-2026-44374

MEDIUM 4.3

Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Backstage is an open framework for building developer portals. Prior to 0.6.11, the unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is an information disclosure vulnerability affecting Backstage installations using this module. This is patched in @backstage/plugin-catalog-backend-module-unprocessed version 0.6.11, @backstage/plugin-catalog-unprocessed-entities-common version 0.0.15 and @backstage/plugin-catalog-unprocessed-entities version 0.2.30.

CWE	CWE-863
Vendor	@backstage
Product	plugin-catalog-backend-module-unprocessed
Published	May 14, 2026

Stay Ahead of the Next One

Get instant alerts for @backstage plugin-catalog-backend-module-unprocessed

Be the first to know when new medium vulnerabilities affecting @backstage plugin-catalog-backend-module-unprocessed are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

@backstage / plugin-catalog-backend-module-unprocessed

< 0.6.11

@backstage / plugin-catalog-unprocessed-entities

< 0.2.30

@backstage / plugin-catalog-unprocessed-entities-common

< 0.0.15

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/backstage/backstage/security/advisories/GHSA-p7g9-rp3g-mgfg