Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@backstage/plugin-catalog-backend-module-unprocessed

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.3npmAmendedPublished

    Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks

    CVE-2026-44374 · GHSA-p7g9-rp3g-mgfg

    Affected
    • npm @backstage/plugin-catalog-backend-module-unprocessed < 0.6.11
    Fixed in
    0.6.11· Vendor fix available
    Issue
    Impact The unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is an information disclosure vulnerability affecting Backstage installations using this module. Patches This is patched in @backstage/plugin-catalog-backend-module-unprocessed version 0.6.11, @backstage/plugin-catalog-unprocessed-entities-common version 0.0.15 and @backstage/plugin-catalog-unprocessed-entities version 0.2.30. Users should upgrade all packages. Workarounds If users cannot upgrade, they can remove the @backstage/plugin-catalog-backend-module-unprocessed module from their backend until the patch is applied. There is no configuration-based workaround to add permission checks to these endpoints without upgrading.

    Recommended action: Upgrade to 0.6.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →