Backstage CVE-2026-106460

Exploitation requires three concrete conditions, all drawn from the advisory: (1) the attacker must be an already-admitted identity-provider user (PR:L) capable of supplying or changing an email address; (2) the Backstage deployment must use an email-based sign-in resolver that resolves catalog identities from the selected profile email; and (3) the email must carry an explicit negative verification flag (profile email verified:false, matching raw provider email_verified:false, or ID-token-only email with email_verified:false). Limiting factors: an absent email_verified claim alone is NOT affected (the negative flag must be present and apply to the selected email); deployments not using the selected-profile-email resolver are not exploitable; and the attacker needs valid IdP admission plus a target catalog email, raising attack complexity (AC:H).

This is a genuine but conditional authentication/identity-spoofing flaw (CWE-287) rather than a trivially exploitable critical. The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, 6.8 Medium) is internally consistent with the description: network vector (OAuth sign-in), high attack complexity (requires a specific resolver configuration plus the ability to control an unverified email), and low privileges (an already-admitted IdP user). The C:H/I:H impact is justified because assuming another catalog identity yields that identity's access and permissions. No EPSS score, KEV listing, or public POC is present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - the GitHub 'source code evidence' is the vendor patch/test commits, NOT exploit code, and must not be conflated with a POC or active exploitation. There is no conflict between signals here; rather, the risk is gated by preconditions (AC:H + PR:L), meaning this is a real priority for Backstage deployments using email-based sign-in resolvers but not a mass-exploitation 'patch-tonight' network worm candidate. Key missing data: EPSS probability and any real-world exploitation telemetry are absent and cannot be inferred.

An attacker who is already an admitted user of the configured identity provider logs in and supplies or changes their profile email to one explicitly marked unverified (email_verified: false) that matches a different Backstage catalog user. Because profile normalization failed to honor the negative verification flag, the email is accepted and used to resolve catalog identity, letting the attacker sign in as the victim and inherit their access. No public exploit code is identified in the provided data, and the attack requires a deployment using the selected-profile-email sign-in resolver.