{"id":"EUVD-2026-94375","enisaUuid":"3136a19a-8d2f-3b53-bb50-6d0803cd00cd","description":"Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject to a DENY policy for search document types could receive unauthorized results in deployments with permission.enabled set to true and an Elasticsearch or OpenSearch backend. This issue is fixed in @backstage/plugin-search-backend 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch 1.8.7.","datePublished":"Oct 7, 2026, 2:54:13 PM","dateUpdated":"Oct 7, 2026, 4:14:59 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/backstage/backstage/security/advisories/GHSA-9325-vq29-gp3v\nhttps://github.com/backstage/backstage/commit/2d5d3e77d630455d6d48cfa8f31fd3c126fd6f29\nhttps://github.com/backstage/backstage/releases/tag/v1.54.1\n","aliases":"CVE-2026-106562\nGHSA-9325-vq29-gp3v\n","assigner":"GitHub_M","epss":0.2,"enisaIdProduct":[{"id":"08d1f59c-51bb-3182-929c-ebf5e296141d","product":{"name":"plugin-search-backend-module-elasticsearch","vendor":{"name":"@backstage"}},"product_version":"\u003c 1.8.7"},{"id":"2dc017dd-4427-3f4d-b46f-dad9f5c5c5cf","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"\u003c 1.54.1"},{"id":"c2837abf-9163-3723-9905-39d98416ccf7","product":{"name":"plugin-search-backend","vendor":{"name":"@backstage"}},"product_version":"\u003c 2.1.6"}],"enisaIdVendor":[{"id":"0a8d00b7-f04e-3933-b0a6-311ac2902bba","vendor":{"name":"@backstage"}},{"id":"b96f0d7c-2f85-3500-af13-cce9c1733cdc","vendor":{"name":"backstage"}}],"enisaIdVulnerability":[{"id":"0fdf4535-1f83-3311-a30c-508105cb2eb5","vulnerability":{"id":"GHSA-9325-vq29-gp3v","description":"Backstage has incorrect authorization in search engine permission filtering","datePublished":"Oct 7, 2026, 6:02:52 PM","dateUpdated":"Oct 7, 2026, 6:02:52 PM","baseScore":0.0,"references":"https://github.com/backstage/backstage/security/advisories/GHSA-9325-vq29-gp3v\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106562\nhttps://github.com/backstage/backstage/commit/2d5d3e77d630455d6d48cfa8f31fd3c126fd6f29\nhttps://github.com/backstage/backstage\nhttps://github.com/backstage/backstage/releases/tag/v1.54.1\n","enisa_id":"EUVD-2026-94375\n","aliases":"CVE-2026-106562\nGHSA-9325-vq29-gp3v\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"2db5fbdb-2948-3b80-8efb-191c0148375f","vulnerability":{"id":"CVE-2026-106562","description":"Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject to a DENY policy for search document types could receive unauthorized results in deployments with permission.enabled set to true and an Elasticsearch or OpenSearch backend. This issue is fixed in @backstage/plugin-search-backend 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch 1.8.7.","datePublished":"Oct 7, 2026, 2:54:13 PM","dateUpdated":"Oct 7, 2026, 4:14:59 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/backstage/backstage/security/advisories/GHSA-9325-vq29-gp3v\nhttps://github.com/backstage/backstage/commit/2d5d3e77d630455d6d48cfa8f31fd3c126fd6f29\nhttps://github.com/backstage/backstage/releases/tag/v1.54.1\n","enisa_id":"EUVD-2026-94375\n","assigner":"GitHub_M","epss":0.2,"dataProcessed":"Oct 27, 2026, 7:16:42 AM","vulnerabilityProduct":[{"id":"0f061565-520c-3953-b439-7da8b71842b3","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"\u003c 1.54.1"},{"id":"5332c7cc-942b-3e29-b329-f1d92ac661f1","product":{"name":"plugin-search-backend-module-elasticsearch","vendor":{"name":"@backstage"}},"product_version":"\u003c 1.8.7"},{"id":"ea95240d-11fe-3cb4-bfc0-f8fa30e0d610","product":{"name":"plugin-search-backend","vendor":{"name":"@backstage"}},"product_version":"\u003c 2.1.6"}],"vulnerabilityVendor":[{"id":"6543fe3e-ccdf-3b48-967f-e5d4037598dc","vendor":{"name":"backstage"}},{"id":"e769e495-763d-38f2-b6e7-107abefb52f0","vendor":{"name":"@backstage"}}]}}],"enisaIdAdvisory":[]}