Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks - @backstage/plugin-catalog-unprocessed-entities-common

Description

The unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is an information disclosure vulnerability affecting Backstage installations using this module.

Recommendation

Update the @backstage/plugin-catalog-unprocessed-entities-common package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.0.15
• Patched version(s): 0.0.15

References

• GHSA-p7g9-rp3g-mgfg
• CVE-2026-44374
• CWE-863
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks - CVE-2026-44374
• TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection - CVE-2026-47761
• payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments) - CVE-2026-25574
• TaffyDB can allow access to any data items in the DB - CVE-2019-10790

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@backstage/plugin-catalog-unprocessed-entities-common