CVE-2026-106460: backstage >= 1.18.0, < 1.49.7, >= 1.50.0-next.0, < 1.54.7; +1 more affected products

Affected technology

backstage · >= 1.18.0, < 1.49.7, >= 1.50.0-next.0, < 1.54.7
backstage

plugin-auth-node · >= 0.3.0, < 0.6.15, >= 0.7.0, < 0.7.5
@backstage

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The user may assume another catalog identity and obtain its associated access and permissions. Vendor/CNA’s CVSS 3.1 assessment (base score 6.8/10) rates confidentiality and integrity impact as high; availability impact as none.