4.3
Medium
CVE-2026-106562 Backstage is an open framework for building developer portals
Description
Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject to a DENY policy for search document types could receive unauthorized results in deployments with permission.enabled set to true and an Elasticsearch or OpenSearch backend. This issue is fixed in @backstage/plugin-search-backend 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch 1.8.7.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| backstage 1.54 | earliest → < 1.54.1 | 1.54.1 |
| plugin-search-backend 2.1 | earliest → < 2.1.6 | 2.1.6 |
| plugin-search-backend-module-elasticsearch 1.8 | earliest → < 1.8.7 | 1.8.7 |
References
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of backstage
The 69 CVEs of backstage →
CVE-2026-115923
Backstage is an open framework for building developer portals
6.5
Medium
CVE-2026-106495
Backstage is an open framework for building developer portals
4.3
Medium
CVE-2026-106557
Backstage is an open framework for building developer portals
7.7
High
CVE-2026-106563
Backstage is an open framework for building developer portals
5.3
Medium