{"id":"GHSA-3xr5-8w6c-p5gw","revision":"425bbf14d95e44b3b03256cd987d0fec","records":[{"revision":"425bbf14d95e44b3b03256cd987d0fec","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-3xr5-8w6c-p5gw","aliases":["CVE-2026-106495"],"title":"Backstage: Improper access control in backend action invocation","description":"### Impact\n\nAn authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced.\n\n### Patches\n\nPatched in `@backstage/backend-defaults` version `0.17.8`\n\n### Workarounds\n\nLimit access to action invocation endpoints to trusted service callers until upgrading.","state":0,"publishedAt":"2026-10-15T20:21:54+00:00","modifiedAt":"2026-10-15T20:30:06.2501809+00:00","affected":[{"ecosystem":"npm","name":"@backstage/backend-defaults","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.17.8"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/backstage/backstage/security/advisories/GHSA-3xr5-8w6c-p5gw","https://nvd.nist.gov/vuln/detail/CVE-2026-106495","https://github.com/backstage/backstage/commit/a8fb34a990a69bcb745e85a3213cf9e5ba2d31a3","https://github.com/backstage/backstage","https://github.com/backstage/backstage/releases/tag/v1.54.6"],"sourceUrl":"https://github.com/advisories/GHSA-3xr5-8w6c-p5gw","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-3xr5-8w6c-p5gw","identifiers":["GHSA-3xr5-8w6c-p5gw","CVE-2026-106495"]},"retained":false,"historicalAffected":[]}],"coverage":[]}