{"id":"CVE-2026-106562","revision":"d7306b0e36c44bc491e4802a6ec76133","records":[{"revision":"d7306b0e36c44bc491e4802a6ec76133","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-106562","aliases":[],"title":"Backstage: Incorrect authorization in search engine permission filtering","description":"Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject to a DENY policy for search document types could receive unauthorized results in deployments with permission.enabled set to true and an Elasticsearch or OpenSearch backend. This issue is fixed in @backstage/plugin-search-backend 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch 1.8.7.","state":0,"publishedAt":"2026-10-07T14:54:13.183+00:00","modifiedAt":"2026-10-07T16:14:59.044+00:00","affected":[{"ecosystem":"Vendor product","name":"backstage","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"backstage\",\n                    \"product\": \"backstage\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.54.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"plugin-search-backend","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@backstage\",\n                    \"product\": \"plugin-search-backend\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.1.6\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"plugin-search-backend-module-elasticsearch","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@backstage\",\n                    \"product\": \"plugin-search-backend-module-elasticsearch\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.8.7\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":"MEDIUM"}],"references":["https://github.com/backstage/backstage/security/advisories/GHSA-9325-vq29-gp3v","https://github.com/backstage/backstage/commit/2d5d3e77d630455d6d48cfa8f31fd3c126fd6f29","https://github.com/backstage/backstage/releases/tag/v1.54.1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-106562","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-106562","identifiers":["CVE-2026-106562"]},"retained":false,"historicalAffected":[]}],"coverage":[]}