[ CVE-2026-106562 · Published 7 Oct 2026 ]
Backstage has incorrect authorization in search engine permission filtering
CVSS 4.3
EPSS <1%Fix available
[ Description ]Official description
Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject to a DENY policy for search document types could receive unauthorized results in deployments with permission.enabled set to true and an Elasticsearch or OpenSearch backend. This issue is fixed in @backstage/plugin-search-backend 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch 1.8.7.
[ Fixes ]Fixes and patches
- @backstage/plugin-search-backend 2.1.6Fixed version · GitHub Advisories · npm package @backstage/plugin-search-backend: upgrade to 2.1.6 or later (affected < 2.1.6)
- @backstage/plugin-search-backend-module-elasticsearch 1.8.7Fixed version · GitHub Advisories · npm package @backstage/plugin-search-backend-module-elasticsearch: upgrade to 1.8.7 or later (affected < 1.8.7)
- Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
- Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ Packages ]Affected open-source packages
- @backstage/plugin-search-backend npmAffected < 2.1.6 · fixed in 2.1.6 · GHSA-9325-vq29-gp3v
- @backstage/plugin-search-backend-module-elasticsearch npmAffected < 1.8.7 · fixed in 1.8.7 · GHSA-9325-vq29-gp3v