Description
The unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is an information disclosure vulnerability affecting Backstage installations using this module.
Recommendation
Update the @backstage/plugin-catalog-unprocessed-entities-common package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.0.15
- Patched version(s): 0.0.15
References
Could your website be exposed too?
SmartScanner can check your website for Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks - @backstage/plugin-catalog-unprocessed-entities-common and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks - CVE-2026-44374
- TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection - CVE-2026-47761
- payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments) - CVE-2026-25574
- TaffyDB can allow access to any data items in the DB - CVE-2019-10790
You might also like:
See something that needs correcting? Let us knowUpdated May 14, 2026