{"id":"EUVD-2026-94012","enisaUuid":"23a9894f-2d06-3023-85cb-fcd15a18c11a","description":"Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for. This issue is fixed in versions 0.16.1 and 0.17.8.","datePublished":"Oct 6, 2026, 8:48:05 PM","dateUpdated":"Oct 9, 2026, 1:51:07 AM","baseScore":7.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","references":"https://github.com/backstage/backstage/security/advisories/GHSA-cq7v-rfgc-5c7v\nhttps://github.com/backstage/backstage/commit/40346245c53e1bf26dee56601e95c5c4ab9cc124\nhttps://github.com/backstage/backstage/commit/bc80ffdafbc92ff7b8c72347eace13cb8688fd33\nhttps://github.com/backstage/backstage/releases/tag/v1.49.6\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","aliases":"CVE-2026-106492\nGHSA-cq7v-rfgc-5c7v\n","assigner":"GitHub_M","epss":0.21,"enisaIdProduct":[{"id":"0b4f51b1-9145-3bed-95a2-7d657c00a256","product":{"name":"backend-defaults","vendor":{"name":"@backstage"}},"product_version":"\u003c 0.16.1"},{"id":"41f57b33-7cf0-38ed-9f37-1197c3ca969e","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"1.50.0-next.0, \u003c 1.54.6"},{"id":"428eb363-cd18-34ba-9024-6238af48c11d","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"\u003c 1.49.6"},{"id":"5150e5d7-4433-3bb4-b3ae-aa39b9c62d59","product":{"name":"backend-defaults","vendor":{"name":"@backstage"}},"product_version":"0.17.0, \u003c 0.17.8"}],"enisaIdVendor":[{"id":"162d7c52-4753-389a-89ea-1909c8aa1ff4","vendor":{"name":"backstage"}},{"id":"5e5bc5a6-cea5-3756-9e0b-850e630d8bb3","vendor":{"name":"@backstage"}}],"enisaIdVulnerability":[{"id":"240882bc-e2f7-3cbf-8ccb-62b6fb428558","vulnerability":{"id":"CVE-2026-106492","description":"Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for. This issue is fixed in versions 0.16.1 and 0.17.8.","datePublished":"Oct 6, 2026, 8:48:05 PM","dateUpdated":"Oct 9, 2026, 1:51:07 AM","status":"PUBLISHED","baseScore":7.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","references":"https://github.com/backstage/backstage/security/advisories/GHSA-cq7v-rfgc-5c7v\nhttps://github.com/backstage/backstage/commit/40346245c53e1bf26dee56601e95c5c4ab9cc124\nhttps://github.com/backstage/backstage/commit/bc80ffdafbc92ff7b8c72347eace13cb8688fd33\nhttps://github.com/backstage/backstage/releases/tag/v1.49.6\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","enisa_id":"EUVD-2026-94012\n","assigner":"GitHub_M","epss":0.21,"dataProcessed":"Oct 29, 2026, 7:16:09 AM","vulnerabilityProduct":[{"id":"153dff66-f3ff-3061-a207-444219dfb271","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"1.50.0-next.0, \u003c 1.54.6"},{"id":"4b538e06-62b6-31cf-8385-6cb3829c1120","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"\u003c 1.49.6"},{"id":"55f6b1e2-66e3-3b50-a0fc-22dd75f93fa7","product":{"name":"backend-defaults","vendor":{"name":"@backstage"}},"product_version":"\u003c 0.16.1"},{"id":"95088b64-77f3-3154-bbd0-67261f919e24","product":{"name":"backend-defaults","vendor":{"name":"@backstage"}},"product_version":"0.17.0, \u003c 0.17.8"}],"vulnerabilityVendor":[{"id":"63e8485d-402d-3523-8385-af1665467e18","vendor":{"name":"backstage"}},{"id":"6d2a7b06-7cc7-37e3-91a1-f33b58c41082","vendor":{"name":"@backstage"}}]}},{"id":"8906291f-6c51-3c82-b525-d0a275950506","vulnerability":{"id":"GHSA-cq7v-rfgc-5c7v","description":"Backstage: Improper preservation of access restrictions during service credential delegation","datePublished":"Oct 7, 2026, 5:59:43 PM","dateUpdated":"Oct 7, 2026, 5:59:44 PM","baseScore":0.0,"references":"https://github.com/backstage/backstage/security/advisories/GHSA-cq7v-rfgc-5c7v\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106492\nhttps://github.com/backstage/backstage/commit/40346245c53e1bf26dee56601e95c5c4ab9cc124\nhttps://github.com/backstage/backstage/commit/bc80ffdafbc92ff7b8c72347eace13cb8688fd33\nhttps://github.com/backstage/backstage\nhttps://github.com/backstage/backstage/releases/tag/v1.49.6\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","enisa_id":"EUVD-2026-94012\n","aliases":"CVE-2026-106492\nGHSA-cq7v-rfgc-5c7v\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}