Backstage CVE-2026-106463

Exploitation requires a deployment that (1) enables GitLab organization event ingestion in the @backstage/plugin-catalog-backend-module-gitlab module and (2) relies on the scoped set of ingested catalog users as an access/sign-in boundary; the patch adds getGroupMemberById to validate that an ingested user is actually a member of the configured GitLab group, confirming the flaw is that org user-creation events were applied without verifying configured-group scope. Limiting factors: the vulnerable org-ingestion/events path is an optional, non-default configuration; the attacker must possess a GitLab account that gets ingested; impact is capped at the privileges of a standard authenticated user per the sign-in and permission configuration (PR:L in the CVSS vector indicates an authenticated precondition); deployments not using scoped catalog users as an access boundary are not meaningfully exposed.

This is a moderate-severity improper-authorization flaw (CWE-863, CVSS 5.4) rather than a high-urgency issue. The provided CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates network reach, low attack complexity, no user interaction, but requires low privileges (PR:L) - consistent with the description's premise that an unintended but authenticated catalog identity is admitted and acts as a standard authenticated user. Impact is partial on confidentiality and integrity (C:L/I:L) with no availability impact, reflecting access limited to what a normal authenticated Backstage user can do, not full compromise. Exploitation status is 'no public exploit identified at time of analysis': there is no CISA KEV listing, no POC referenced, and no EPSS score was supplied in the input, so real-world exploitation probability cannot be quantified from the data given. The signals are internally consistent - there is no CVSS-versus-description conflict - but the dependency on a specific optional feature (GitLab organization event ingestion) and on using scoped catalog users as an access boundary means realistic exploitability is conditional, not universal. Net assessment: a genuine authorization-boundary bug worth patching on normal maintenance cadence for affected deployments, not a drop-everything emergency absent evidence of active exploitation.

An organization runs Backstage with GitLab organization event ingestion enabled and relies on the set of ingested (scoped) catalog users to decide who may sign in. A GitLab user who falls outside the intended group scope is nonetheless ingested as a catalog identity due to missing group-membership validation, then signs in and operates with the permissions of a standard authenticated Backstage user. No public exploit code is referenced for this issue.