Improper Authorization in Backstage GitLab Plugin

CVE-2026-106463

What is CVE-2026-106463?

The @backstage/plugin-catalog-backend-module-gitlab package in Backstage, prior to version 0.8.7, is susceptible to improper authorization. This vulnerability affects deployments that rely on GitLab organization event ingestion, where improperly scoped users may gain access to catalog identities they should not have. If permission settings and sign-in configurations are not correctly aligned, unauthorized access to sensitive data could be achieved using the permissions of an authenticated user. An upgrade to version 0.8.7 or later is recommended to mitigate this risk.

References