Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent catalog property permission evaluation. In deployments that use affected value-based catalog permission conditions as a confidentiality boundary, an authenticated user could receive catalog entity data that policy authors intended to restrict. This issue is fixed in version 3.9.1.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/backstage/backstage/commit/21424faa2e280a6bc6b9e5c5245952f16aafca7b Patch
- https://github.com/backstage/backstage/releases/tag/v1.54.6 Patch, Release Notes
- https://github.com/backstage/backstage/security/advisories/GHSA-8429-xpcj-3cg5 Mitigation, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 4.3 · linuxfoundationNVD modified 2026-10-16 15:26
Affected (CPE criteria) 2
cpe:2.3:a:linuxfoundation:backstage_plugin-catalog-backend:*:*:*:*:*:node.js:*:*cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*