4.3
Moyenne
CVE-2026-106562 Backstage is an open framework for building developer portals
Description
Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject to a DENY policy for search document types could receive unauthorized results in deployments with permission.enabled set to true and an Elasticsearch or OpenSearch backend. This issue is fixed in @backstage/plugin-search-backend 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch 1.8.7.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| backstage 1.54 | premières → < 1.54.1 | 1.54.1 |
| plugin-search-backend 2.1 | premières → < 2.1.6 | 2.1.6 |
| plugin-search-backend-module-elasticsearch 1.8 | premières → < 1.8.7 | 1.8.7 |
Références
- github.com github.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de backstage
Les 69 CVE de backstage →
CVE-2026-115923
Backstage is an open framework for building developer portals
6.5
Moyenne
CVE-2026-106495
Backstage is an open framework for building developer portals
4.3
Moyenne
CVE-2026-106557
Backstage is an open framework for building developer portals
7.7
Élevée
CVE-2026-106563
Backstage is an open framework for building developer portals
5.3
Moyenne