Riskcovery

CVE-2026-106562

Backstage: Incorrect authorization in search engine permission filtering

State
Published
Severity
4.3 Medium
Published
Oct 7, 2026
Updated
Oct 7, 2026
Reserved
Oct 6, 2026

Read the record on cve.org

Description

Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject to a DENY policy for search document types could receive unauthorized results in deployments with permission.enabled set to true and an Elasticsearch or OpenSearch backend. This issue is fixed in @backstage/plugin-search-backend 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch 1.8.7.

Scores

CVSSScoreVectorSource
3.14.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NGitHub_M

Weaknesses

  • CWE-754 Improper Check for Unusual or Exceptional Conditions
  • CWE-863 Incorrect Authorization

Affected Products

ProductVersions
backstagebackstage
  • < 1.54.1Affected
plugin-search-backend@backstage
  • < 2.1.6Affected
plugin-search-backend-module-elasticsearch@backstage
  • < 1.8.7Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.