Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks

Description

The unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is an information disclosure vulnerability affecting Backstage installations using this module.

Recommendation

Update the @backstage/plugin-catalog-unprocessed-entities package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.2.30
• Patched version(s): 0.2.30

References

• GHSA-p7g9-rp3g-mgfg
• CVE-2026-44374
• CWE-863
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks - @backstage/plugin-catalog-unprocessed-entities-common - CVE-2026-44374
• TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection - CVE-2026-47761
• TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes - CVE-2026-47759
• Cross site scripting Vulnerability in backstage Software Catalog - CVE-2023-25571

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@backstage/plugin-catalog-unprocessed-entities