Backstage: Improper access control in backend action invocation

影響: npm:@backstage/backend-defaults < 0.17.8 → 0.17.8

An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced. Patches Patched in @backstage/backend-defaults version 0.17.8 Workarounds Limit access to action invocation endpoints to trusted service callers until upgrading.

Read on GitHub Advisory Database

On 10/16/2026, 05:21 AM, GitHub Advisory Database published "Backstage: Improper access control in backend action invocation" (type: Advisory). Severity is "Medium" (medium). Related technologies: JavaScript / Node.js. CVE: CVE-2026-106495.