EUVD-2026-94056
GHSA-qgvj-qcf8-xq73
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Authenticated catalog-write user (PR:L) sends a crafted entity over the network (AV:N/AC:L); reading another repo's data crosses the authorization boundary (S:C, C:H) with no integrity or availability impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
6Blast Radius
ecosystem impact- 29 npm packages depend on @backstage/plugin-catalog-backend (14 direct, 15 indirect)
Ecosystem-wide dependent count for version 3.9.1.
DescriptionCVE.org
Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend package is affected by improper url validation in catalog entity placeholder resolution. An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user. This issue is fixed in versions 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1.
AnalysisAI
Improper URL validation in the @backstage/plugin-catalog-backend package of Backstage prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1 lets an authenticated user with catalog-write capability craft catalog entities whose placeholder directives ($text, $json, $yaml) resolve to files in a repository other than the entity's own source repo. Because the placeholder resolver executes with the backend's configured SCM integration credentials, the attacker can read content the resolver is authorized to fetch but that the user should not see, giving a confidentiality impact rated 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Backstage user who is permitted to register or craft catalog entities (catalog-info.yaml) containing placeholder directives such as $text/$json/$yaml. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-priority authorization flaw (CWE-863) rather than a top-tier emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade @backstage/plugin-catalog-backend to 3.5.1, 3.6.2, 3.7.2, 3.8.2 or 3.9.1 on the applicable release line (equivalently, upgrade the Backstage framework to v1.49.6, v1.50.5, v1.51.3, v1.53.2 or v1.54.6); the underlying fixes are the commits 0b0f6fc89b4eb4872c76a498abbe1dc65998bb6e, 286bfc1f9cc3608a073b41016be302785be385d1, 61a10f19926aeda7f4a32de48d733e6710584634, 99729e925fd2bd40ba210022351a0ee6318e6197 and e786ac309ed2d775daf2309393c015c43902d6f6, and full details are in GHSA-qgvj-qcf8-xq73. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Backstage deployments using @backstage/plugin-catalog-backend and identify the running version against the affected ranges (prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2, and 3.9.1); restrict catalog-write permissions to the smallest possible group, audit recent catalog entity changes for unauthorized or unexpected placeholder directives ($text, $json, $yaml), and review SCM integration credentials for over-broad repository scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Backstage is an open platform for building developer portals. Rated critical severity (CVSS 9.9), this vulnerability is
Authenticated Backstage users can retrieve the internal execution data of other users' Scaffolder tasks - notably the Se
Authenticated users who can register or modify a TechDocs documentation source can achieve code execution inside the Bac
Arbitrary Python code execution in Backstage's @backstage/plugin-techdocs-node (versions < 1.13.11 and = 1.14.0) lets a
Authenticated remote code execution in the @backstage/plugin-techdocs-node package shipped with the Backstage developer
Improper task-state validation in the @backstage/plugin-scaffolder-backend plugin (Backstage versions prior to 3.3.1, 3.
Path traversal in the Backstage Scaffolder Bitbucket pull-request publish actions allows an authenticated user who can e
Improper input validation in the @backstage/plugin-scaffolder-backend-module-sentry scaffolder actions (Backstage 0.3.0
@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Rated high severity (C
Improper authentication in the Backstage @backstage/plugin-auth-backend-module-oidc-provider package prior to 0.4.20 let
Server-side request forgery in the Backstage @backstage/plugin-techdocs-node package (0.11.12 through 1.14.6, and 1.15.0
Improper validation of MkDocs Markdown extension configuration in Backstage's TechDocs Node package (@backstage/plugin-t
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today