What is the CVSS score of EUVD-2026-30295?

EUVD-2026-30295 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-30295?

Yes, a patch is available for EUVD-2026-30295. Update the affected software to the latest version immediately.

Backstage Catalog Plugin EUVD-2026-30295

| CVE-2026-44374 MEDIUM

Incorrect Authorization (CWE-863)

2026-05-06 https://github.com/backstage/backstage

GHSA-p7g9-rp3g-mgfg

Authentication Bypass Information Disclosure

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable endpoints require authenticated session (PR:L); only limited catalog metadata disclosed with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

4.3 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 23:05 vuln.today

Analysis Generated

Jul 23, 2026 - 23:05 vuln.today

CVE Published

May 06, 2026 - 23:04 nvd

MEDIUM 4.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on @backstage/plugin-catalog-unprocessed-entities-common (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.0.15.

DescriptionGitHub Advisory

Impact

The unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is an information disclosure vulnerability affecting Backstage installations using this module.

Patches

This is patched in @backstage/plugin-catalog-backend-module-unprocessed version 0.6.11, @backstage/plugin-catalog-unprocessed-entities-common version 0.0.15 and @backstage/plugin-catalog-unprocessed-entities version 0.2.30. Users should upgrade all packages.

Workarounds

If users cannot upgrade, they can remove the @backstage/plugin-catalog-backend-module-unprocessed module from their backend until the patch is applied. There is no configuration-based workaround to add permission checks to these endpoints without upgrading.

AnalysisAI

Unauthorized cross-owner data access in Backstage's catalog-backend-module-unprocessed plugin allows any authenticated user to read unprocessed entity records belonging to other teams or owners, bypassing the Backstage permission framework entirely. The vulnerability affects all installations of this optional plugin running versions prior to 0.6.11 of @backstage/plugin-catalog-backend-module-unprocessed, 0.0.15 of the common package, and 0.2.30 of the UI package. EPSS is 0.03% (7th percentile) and the vulnerability is not in CISA KEV, indicating low exploitation probability; however, in multi-tenant Backstage deployments the data exposure risk is real and no public exploit has been identified at time of analysis.

Technical ContextAI

Backstage is an open-source internal developer platform framework built by Spotify and now a CNCF project. The affected packages - pkg:npm/@backstage/plugin-catalog-backend-module-unprocessed, pkg:npm/@backstage/plugin-catalog-unprocessed-entities-common, and pkg:npm/@backstage/plugin-catalog-unprocessed-entities - form a plugin suite for surfacing catalog entities that have been ingested but not yet processed. The root cause is CWE-863 (Incorrect Authorization): the backend read endpoints in this module were implemented without integrating Backstage's native permission framework, so authorization decisions are never evaluated before responding to requests. Because Backstage uses a pluggable permission model (not default-deny unless explicitly wired), omitting permission checks causes these endpoints to be entirely open to any authenticated session, regardless of entity ownership or team membership.

RemediationAI

Upgrade all three affected packages simultaneously to their patched versions: @backstage/plugin-catalog-backend-module-unprocessed to 0.6.11, @backstage/plugin-catalog-unprocessed-entities-common to 0.0.15, and @backstage/plugin-catalog-unprocessed-entities to 0.2.30, as documented in the GitHub Security Advisory at https://github.com/backstage/backstage/security/advisories/GHSA-p7g9-rp3g-mgfg. The vendor explicitly requires upgrading all three packages together. If an immediate upgrade is not feasible, the only supported workaround is to remove the @backstage/plugin-catalog-backend-module-unprocessed module from the Backstage backend entirely - this disables the unprocessed entity visibility feature but eliminates the exposure. There is no configuration-based workaround that adds permission checks without upgrading; applying network-layer controls (e.g., restricting the affected endpoints via a reverse proxy) is a possible compensating control but may break legitimate functionality and is not vendor-endorsed.