Backend Defaults
Monthly
Improper preservation of access restrictions in Backstage's @backstage/backend-defaults package lets an authenticated holder of a restricted external service credential (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, rated 7.6) escalate privileges by routing requests through plugin-to-plugin delegation: the credential's permission-name or permission-attribute limits (for example action:read) are dropped when a plugin request token is minted on the credential's behalf, so a read-only principal can perform write operations on plugins it should only be able to read. Only deployments that both use @backstage/backend-defaults and configure external service credentials with accessRestrictions are exposed, and exploitation is scoped to plugins reachable through the delegation path. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); fixed releases are @backstage/backend-defaults 0.16.1 and 0.17.8.
Improper access control in the @backstage/backend-defaults package of the Backstage developer portal framework (versions prior to 0.17.8, shipped in Backstage releases before v1.54.6) allows an authenticated user to invoke backend actions that an operator had explicitly excluded through backend.actions configuration. The excluded actions are filtered out when actions are listed, but the invocation path never re-applied those filters, so a caller who knows or guesses an action ID can still trigger it; per-action permissions and downstream authorization remain enforced, which caps the impact at a low-integrity exposure (CVSS 4.3, C:N/I:L/A:N). There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), and the issue only matters in deployments that actually configured action exclusions. Fixed in @backstage/backend-defaults 0.17.8.
Content injection in Backstage's cloud storage URL readers (the @backstage/backend-defaults package before 0.17.8) allows an attacker who holds write access to a configured AWS S3 bucket, AWS CodeCommit repository, or Azure Blob Storage container to craft object names containing path traversal segments so that an ingested object can collide with a protected file in the reader's output directory, overwriting or injecting content in certain deployment configurations. The issue is a CWE-22 improper-limitation-of-pathname flaw with an integrity-only impact, scored CVSS 4.4 (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N), meaning exploitation demands high privileges (bucket write access) and a non-trivial collision condition, while confidentiality and availability are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available in @backstage/backend-defaults 0.17.8 (Backstage v1.54.6).
Improper preservation of access restrictions in Backstage's @backstage/backend-defaults package lets an authenticated holder of a restricted external service credential (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, rated 7.6) escalate privileges by routing requests through plugin-to-plugin delegation: the credential's permission-name or permission-attribute limits (for example action:read) are dropped when a plugin request token is minted on the credential's behalf, so a read-only principal can perform write operations on plugins it should only be able to read. Only deployments that both use @backstage/backend-defaults and configure external service credentials with accessRestrictions are exposed, and exploitation is scoped to plugins reachable through the delegation path. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); fixed releases are @backstage/backend-defaults 0.16.1 and 0.17.8.
Improper access control in the @backstage/backend-defaults package of the Backstage developer portal framework (versions prior to 0.17.8, shipped in Backstage releases before v1.54.6) allows an authenticated user to invoke backend actions that an operator had explicitly excluded through backend.actions configuration. The excluded actions are filtered out when actions are listed, but the invocation path never re-applied those filters, so a caller who knows or guesses an action ID can still trigger it; per-action permissions and downstream authorization remain enforced, which caps the impact at a low-integrity exposure (CVSS 4.3, C:N/I:L/A:N). There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), and the issue only matters in deployments that actually configured action exclusions. Fixed in @backstage/backend-defaults 0.17.8.
Content injection in Backstage's cloud storage URL readers (the @backstage/backend-defaults package before 0.17.8) allows an attacker who holds write access to a configured AWS S3 bucket, AWS CodeCommit repository, or Azure Blob Storage container to craft object names containing path traversal segments so that an ingested object can collide with a protected file in the reader's output directory, overwriting or injecting content in certain deployment configurations. The issue is a CWE-22 improper-limitation-of-pathname flaw with an integrity-only impact, scored CVSS 4.4 (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N), meaning exploitation demands high privileges (bucket write access) and a non-trivial collision condition, while confidentiality and availability are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available in @backstage/backend-defaults 0.17.8 (Backstage v1.54.6).