CVE-2026-44374: Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks
Impact
The unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is an information disclosure vulnerability affecting Backstage installations using this module. ### Patches This is patched in @backstage/plugin-catalog-backend-module-unprocessed version 0.6.11, @backstage/plugin-catalog-unprocessed-entities-common version 0.0.15 and @backstage/plugin-catalog-unprocessed-entities version 0.2.30. Users should upgrade all packages. ### Workarounds If users cannot upgrade, they can remove the @backstage/plugin-catalog-backend-module-unprocessed module from their backend until the patch is applied. There is no configuration-based workaround to add permission checks to these endpoints without upgrading.
Other sources
Backstage is an open framework for building developer portals. Prior to 0.6.11, the unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is an information disclosure vulnerability affecting Backstage installations using this module. This is patched in @backstage/plugin-catalog-backend-module-unprocessed version 0.6.11, @backstage/plugin-catalog-unprocessed-entities-common version 0.0.15 and @backstage/plugin-catalog-unprocessed-entities version 0.2.30.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44374?
CVE-2026-44374 is classified as an information disclosure vulnerability due to unprocessed entities being accessible without proper authorization checks.
How do I fix CVE-2026-44374?
To fix CVE-2026-44374, update to version 0.6.11 of @backstage/plugin-catalog-backend-module-unprocessed, version 0.2.30 of @backstage/plugin-catalog-unprocessed-entities, or version 0.0.15 of @backstage/plugin-catalog-unprocessed-entities-common.
Who is affected by CVE-2026-44374?
Any application using the affected versions of @backstage/plugin-catalog-backend-module-unprocessed, @backstage/plugin-catalog-unprocessed-entities, or @backstage/plugin-catalog-unprocessed-entities-common is at risk.
What is the impact of CVE-2026-44374 on users?
Users with authentication can access unprocessed entity records regardless of their ownership, leading to potential exposure of sensitive information.
Are there any workarounds for CVE-2026-44374 before applying a patch?
Currently, there are no documented workarounds for CVE-2026-44374, and applying the patch is the recommended approach.