What’s Vulnerable › Vulnerabilities

CVE-2026-106463: Backstage: Improper authorization in GitLab organizational user ingestion

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-06 · updated 2026-10-22
• Weakness: CWE-863

Description

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthorized access with the permissions of a standard authenticated user. This issue is fixed in version 0.8.7.

Affected products

• backstage: before 1.54.6 — fixed in 1.54.6
• Linuxfoundation Backstage/Plugin-Catalog-Backend-Module-Gitlab: before 0.8.7 — fixed in 0.8.7

How to fix

Upgrade to a fixed version: backstage 1.54.6; Linuxfoundation Backstage/Plugin-Catalog-Backend-Module-Gitlab 0.8.7. Check the vendor advisory for mitigations.

References

• https://github.com/backstage/backstage/commit/c211b4b67d28efd2f4fac63e35e2ac515e305cb3
• https://github.com/backstage/backstage/releases/tag/v1.54.6
• https://github.com/backstage/backstage/security/advisories/GHSA-gp6m-x9vw-5c5x

Get alerted when CVE-2026-106463 or the next vulnerability affects your stack