{"id":"CVE-2026-106492","revision":"b966b767668c4272a86314a930f936fd","records":[{"revision":"b966b767668c4272a86314a930f936fd","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-106492","aliases":[],"title":"Backstage: Improper preservation of access restrictions during service credential delegation","description":"Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for. This issue is fixed in versions 0.16.1 and 0.17.8.","state":0,"publishedAt":"2026-10-06T20:48:05.896+00:00","modifiedAt":"2026-10-09T01:51:07.252+00:00","affected":[{"ecosystem":"Vendor product","name":"backstage","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"backstage\",\n                    \"product\": \"backstage\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.49.6\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 1.50.0-next.0, < 1.54.6\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"backend-defaults","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@backstage\",\n                    \"product\": \"backend-defaults\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.16.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 0.17.0, < 0.17.8\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","score":7.6,"severity":"HIGH"}],"references":["https://github.com/backstage/backstage/security/advisories/GHSA-cq7v-rfgc-5c7v","https://github.com/backstage/backstage/commit/40346245c53e1bf26dee56601e95c5c4ab9cc124","https://github.com/backstage/backstage/commit/bc80ffdafbc92ff7b8c72347eace13cb8688fd33","https://github.com/backstage/backstage/releases/tag/v1.49.6","https://github.com/backstage/backstage/releases/tag/v1.54.6"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-106492","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-106492","identifiers":["CVE-2026-106492"]},"retained":false,"historicalAffected":[]}],"coverage":[]}