CVE-2026-106495 with a CVSS score of 4.3 is a medium-severity improper access control vulnerability in the Backstage backend action invocation component of the @backstage/backend-defaults npm package. The affected versions are @backstage/backend-defaults (npm) versions < 0.17.8. The flaw occurs when an authenticated user can invoke backend actions that an operator had excluded through action configuration, even though existing action permissions and downstream authorization remain enforced. The attack vector is network-based, requires low privileges, and does not require user interaction or complex conditions, allowing a low-privilege authenticated actor to reach action invocation endpoints and trigger actions outside the intended exclusion set. Because the issue does not compromise confidentiality or availability but can reduce integrity, the business impact is primarily unauthorized execution of configured backend actions, potentially causing unintended state changes, workflow disruption, or policy bypass within systems that rely on Backstage backend actions for operational or administrative tasks. The vulnerability is limited by the continued enforcement of existing action permissions and downstream authorization, but it still weakens the expected access-control boundary for excluded actions and may expose organizations to operational risk if sensitive actions are reachable by users who should not be able to invoke them.
We recommend you to update @backstage/backend-defaults to version 0.17.8.[/subscribe_to_unlock_form]
CVE-2026-106495 with a CVSS score of 4.3 is a medium-severity improper access control vulnerability in the Backstage backend action invocation component of the @backstage/backend-defaults npm package. The affected versions are @backstage/backend-defaults (npm) versions < 0.17.8. The flaw occurs when an authenticated user can invoke backend actions that an operator had excluded through action configuration, even though existing action permissions and downstream authorization remain enforced. The attack vector is network-based, requires low privileges, and does not require user interaction or complex conditions, allowing a low-privilege authenticated actor to reach action invocation endpoints and trigger actions outside the intended exclusion set. Because the issue does not compromise confidentiality or availability but can reduce integrity, the business impact is primarily unauthorized execution of configured backend actions, potentially causing unintended state changes, workflow disruption, or policy bypass within systems that rely on Backstage backend actions for operational or administrative tasks. The vulnerability is limited by the continued enforcement of existing action permissions and downstream authorization, but it still weakens the expected access-control boundary for excluded actions and may expose organizations to operational risk if sensitive actions are reachable by users who should not be able to invoke them.
We recommend you to update @backstage/backend-defaults to version 0.17.8.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]