Description
The unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is an information disclosure vulnerability affecting Backstage installations using this module.
Recommendation
Update the @backstage/plugin-catalog-unprocessed-entities package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.2.30
- Patched version(s): 0.2.30
References
Could your website be exposed too?
SmartScanner can check your website for Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks - @backstage/plugin-catalog-unprocessed-entities-common - CVE-2026-44374
- TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection - CVE-2026-47761
- TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes - CVE-2026-47759
- Cross site scripting Vulnerability in backstage Software Catalog - CVE-2023-25571
You might also like:
See something that needs correcting? Let us knowUpdated May 14, 2026