{"id":"ghsa-ghsa-3xr5-8w6c-p5gw","seq":2470,"kind":"advisory","title":"Backstage: Improper access control in backend action invocation","url":"https://github.com/advisories/GHSA-3xr5-8w6c-p5gw","permalink":"https://vulnpulse.app/items/ghsa-ghsa-3xr5-8w6c-p5gw","summary":"影響: npm:@backstage/backend-defaults < 0.17.8 → 0.17.8\nImpact An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced. Patches Patched in @backstage/backend-defaults version 0.17.8 Workarounds Limit access to action invocation endpoints to trusted service callers until upgrading.","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-106495"],"tags":["GHSA-3xr5-8w6c-p5gw","@backstage/backend-defaults"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-15T20:21:54.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}