Backstage: Improper access control in backend action invocation

影響: npm:@backstage/backend-defaults < 0.17.8 → 0.17.8

An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced. Patches Patched in @backstage/backend-defaults version 0.17.8 Workarounds Limit access to action invocation endpoints to trusted service callers until upgrading.

GitHub Advisory Databaseで読む

2026/10/16 05:21、GitHub Advisory Databaseが「Backstage: Improper access control in backend action invocation」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: JavaScript / Node.js。CVE: CVE-2026-106495。