Confidentiality Issue in Backstage Plugin Catalog

CVE-2026-106497

What is CVE-2026-106497?

In Backstage, an open framework for building developer portals, the '@backstage/plugin-catalog-backend' package prior to version 3.9.1 has a vulnerability related to inconsistent evaluation of catalog property permissions. This flaw can potentially allow an authenticated user to access catalog entity data that policy authors intended to protect when using affected value-based catalog permission conditions. Organizations using this package should upgrade to version 3.9.1 or later to mitigate the risk associated with this issue.

References