CVE-2026-106495

4.3Medium

Published 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-284

Impact

Authenticated users can execute backend actions that operators explicitly disabled via configuration. Downstream authorization and action permissions are still enforced, limiting what can be modified.

Root cause

Improper access control fails to respect exclusion configurations when dispatching backend action invocations.

Affected systems

@backstage/backend-defaults prior to 0.17.8

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Fix & remediation

Upgrade @backstage/backend-defaults to version 0.17.8 or later. No interim mitigation is documented.

shell

$ yarn up @backstage/backend-defaults@^0.17.8

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced. This issue is fixed in version 0.17.8.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-106495