Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-106497

Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent catalog property permission evaluation. In deployments that use affected value-based catalog permission conditions as a confidentiality boundary, an authenticated user could receive catalog entity data that policy authors intended to restrict. This issue is fixed in version 3.9.1.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 8.4%
CVSS Severity
CVSS v3 Score 4.3
Products affected by CVE-2026-106497


Contact Us

Shodan ® - All rights reserved