Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks
Moderate severity
GitHub Reviewed
Published
Apr 29, 2026
in
backstage/backstage
•
Updated May 6, 2026
Description
Published to the GitHub Advisory Database
May 6, 2026
Reviewed
May 6, 2026
Last updated
May 6, 2026
Impact
The unprocessed entities read endpoints in
@backstage/plugin-catalog-backend-module-unprocesseddo not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This isan information disclosure vulnerability affecting Backstage installations using this module.
Patches
This is patched in
@backstage/plugin-catalog-backend-module-unprocessedversion 0.6.11,@backstage/plugin-catalog-unprocessed-entities-commonversion 0.0.15 and@backstage/plugin-catalog-unprocessed-entitiesversion 0.2.30. Users should upgrade all packages.Workarounds
If users cannot upgrade, they can remove the
@backstage/plugin-catalog-backend-module-unprocessedmodule from their backend until the patch is applied. There is no configuration-based workaround to add permission checks to these endpointswithout upgrading.
References