CVE-2026-44374: medium-severity vulnerability in @backstage plugin-catalog-backend-module-unproc…
Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks
Published
Follow this CVE+ Monitor plugin-catalog-backend-module-unprocessed+ Monitor plugin-catalog-unprocessed-entities
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.3epss 0.2%
Backstage is an open framework for building developer portals. Prior to 0.6.11, the unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is an information disclosure vulnerability affecting Backstage installations using this module. This is patched in @backstage/plugin-catalog-backend-module-unprocessed version 0.6.11, @backstage/plugin-catalog-unprocessed-entities-common version 0.0.15 and @backstage/plugin-catalog-unprocessed-entities version 0.2.30.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N