Skip to content
OpenAdvisories

Product · backstage

backend-defaults

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-106495

    Backstage: Improper access control in backend action invocation

    Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had exclud…

    backstage backstage backend-defaults @backstage/backend-defaults npm
  • Medium 4.4
    CVE-2026-106494

    Backstage: Improper input validation in cloud storage URL readers

    Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper input validation in cloud storage url readers. An attacker with write access to a cloud storage bucket used by Back…

    backstage backstage backend-defaults @backstage/backend-defaults npm