Backstage: Improper access control in backend action invocation

影響: npm:@backstage/backend-defaults < 0.17.8 → 0.17.8

An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced. Patches Patched in @backstage/backend-defaults version 0.17.8 Workarounds Limit access to action invocation endpoints to trusted service callers until upgrading.

GitHub Advisory Database에서 읽기

2026. 10. 16. 오전 05:21, GitHub Advisory Database에서 "Backstage: Improper access control in backend action invocation"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-106495.