Skip to content
OpenAdvisories
Medium · 5.4 CVE-2026-106463 EUVD-2026-94000GHSA-gp6m-x9vw-5c5x

Backstage: Improper authorization in GitLab organizational user ingestion

Published Oct 6, 2026 · Updated Oct 7, 2026 · Assigned by GitHub_M

Description

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthorized access with the permissions of a standard authenticated user. This issue is fixed in version 0.8.7.

Affected products

VendorProductAffectedFixed
backstage backstage < 1.54.6 —
@backstage plugin-catalog-backend-module-gitlab < 0.8.7 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm @backstage/plugin-catalog-backend-module-gitlab < 0.8.7 0.8.7 GHSA-gp6m-x9vw-5c5x

References