Backstage: Improper access control in backend action invocation

影響: npm:@backstage/backend-defaults < 0.17.8 → 0.17.8

An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced. Patches Patched in @backstage/backend-defaults version 0.17.8 Workarounds Limit access to action invocation endpoints to trusted service callers until upgrading.

在 GitHub Advisory Database 阅读

2026/10/16 05:21，GitHub Advisory Database 发布了“Backstage: Improper access control in backend action invocation”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：JavaScript / Node.js。CVE：CVE-2026-106495。