Dashboard / CVE-2026-44374

CVE-2026-44374

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 59/100
Published: 2026-05-14 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: Low
I: None
A: None

Description

Backstage is an open framework for building developer portals. Prior to 0.6.11, the unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is an information disclosure vulnerability affecting Backstage installations using this module. This is patched in @backstage/plugin-catalog-backend-module-unprocessed version 0.6.11, @backstage/plugin-catalog-unprocessed-entities-common version 0.0.15 and @backstage/plugin-catalog-unprocessed-entities version 0.2.30.

Weakness Classification (1)

Affected Software (3)

VendorProductVersion
linuxfoundation backstage\/plugin-catalog-backend-module-unprocessed < 0.6.11
linuxfoundation backstage\/plugin-catalog-unprocessed-entities < 0.2.30
linuxfoundation backstage\/plugin-catalog-unprocessed-entities-common < 0.0.15

References & Advisories (1)

Bug Bounty Relevance

59 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

4.3 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS — Exploitation Probability

0.17%
Raw Score 0.001700
Percentile 6.4%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00170
2026-10-28
0.00170

Intelligence Sources

nvd ref →

External Links