## Backstage: Improper access control in backend action invocation

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- CVE: CVE-2026-106495
- 公開日時: 2026-10-15T20:21:54.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-3xr5-8w6c-p5gw)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-3xr5-8w6c-p5gw

影響: npm:@backstage/backend-defaults < 0.17.8 → 0.17.8
Impact An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced. Patches Patched in @backstage/backend-defaults version 0.17.8 Workarounds Limit access to action invocation endpoints to trusted service callers until upgrading.