CVE-2026-106495
Description
A flaw was found in Backstage. An authenticated user can bypass configuration restrictions and invoke backend actions that an administrator intended to exclude. Although underlying action permissions and downstream authorization checks remain enforced, this flaw permits unauthorized execution of functionality that was meant to be disabled.
Statement
A flaw of moderate severity was found in the upstream Backstage developer portal framework, in the @backstage/backend-defaults npm package. The package implements improper access control over backend action invocation: a remote attacker with an authenticated Backstage user account could invoke backend actions that an administrator had excluded through action configuration, resulting in unauthorized execution of functionality that was meant to be disabled. Existing action permissions and downstream authorization checks remain enforced, so the impact is limited to this low integrity violation with no direct impact on confidentiality or availability (CVSS 4.3, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). At this time, no Red Hat products are listed as affected by this flaw, and the Red Hat severity is in line with the upstream assessment.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Upstream fixed this issue in the 0.17.8 release of the @backstage/backend-defaults package; deployments consuming that package directly from npm can upgrade to version 0.17.8 or later.
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability,Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Read Application Data; Modify Application Data; Execute Unauthorized Code or Commands; Other
Exposing critical functionality essentially provides an attacker with the privilege level of the exposed functionality. The consequences may vary depending on the behavior of the exposed method. Typically, this could result in the modification or exposure of sensitive data or possibly even execution of arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
