CVE-2026-44374

{
  "id": "CVE-2026-44374",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-14T15:16:48.250",
  "lastModified": "2026-10-26T14:10:00.130",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Backstage is an open framework for building developer portals. Prior to 0.6.11, the unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is an information disclosure vulnerability affecting Backstage installations using this module. This is patched in @backstage/plugin-catalog-backend-module-unprocessed version 0.6.11, @backstage/plugin-catalog-unprocessed-entities-common version 0.0.15 and @backstage/plugin-catalog-unprocessed-entities version 0.2.30."
    },
    {
      "lang": "es",
      "value": "Backstage es un framework abierto para construir portales de desarrolladores. Antes de la versión 0.6.11, los endpoints de lectura de entidades no procesadas en @backstage/plugin-catalog-backend-module-unprocessed no aplican comprobaciones de autorización de permisos. Cualquier usuario autenticado puede acceder a los registros de entidades no procesadas independientemente de la propiedad. Esto es una vulnerabilidad de revelación de información que afecta a las instalaciones de Backstage que utilizan este módulo. Esto está parcheado en @backstage/plugin-catalog-backend-module-unprocessed versión 0.6.11, @backstage/plugin-catalog-unprocessed-entities-common versión 0.0.15 y @backstage/plugin-catalog-unprocessed-entities versión 0.2.30."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "@backstage",
          "product": "plugin-catalog-backend-module-unprocessed",
          "versions": [
            {
              "version": "< 0.6.11",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "@backstage",
          "product": "plugin-catalog-unprocessed-entities",
          "versions": [
            {
              "version": "< 0.2.30",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "@backstage",
          "product": "plugin-catalog-unprocessed-entities-common",
          "versions": [
            {
              "version": "< 0.0.15",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-14T16:02:43.037594Z",
          "id": "CVE-2026-44374",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:linuxfoundation:backstage\\/plugin-catalog-backend-module-unprocessed:*:*:*:*:*:node.js:*:*",
              "versionEndExcluding": "0.6.11",
              "matchCriteriaId": "109B2D64-CFBC-4239-AF3A-1BF91F63B6F5"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:linuxfoundation:backstage\\/plugin-catalog-unprocessed-entities:*:*:*:*:*:node.js:*:*",
              "versionEndExcluding": "0.2.30",
              "matchCriteriaId": "62811CDB-F9EE-48A5-BE85-0A298D696634"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:linuxfoundation:backstage\\/plugin-catalog-unprocessed-entities-common:*:*:*:*:*:node.js:*:*",
              "versionEndExcluding": "0.0.15",
              "matchCriteriaId": "D2969930-3D83-4C7F-9B4D-AC193282F7E3"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/backstage/backstage/security/advisories/GHSA-p7g9-rp3g-mgfg",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}