All vulnerabilities
CVE-2026-106463GHSA-gp6m-x9vw-5c5x

Backstage has improper authorization in GitLab organizational user ingestion

backstage @backstage/plugin-catalog-backend-module-gitlabnpmApplications & CMS
Open in ThreatlineRecord JSON
CVSS
5.4Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.8.7Fixed versionGitHub
Published6 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

  • 0.8.7@backstage/plugin-catalog-backend-module-gitlab, npmGitHubnpm install @backstage/plugin-catalog-backend-module-gitlab@0.8.7

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthorized access with the permissions of a standard authenticated user.

Patches

  • Upgrade @backstage/plugin-catalog-backend-module-gitlab to version 0.8.7.

Workarounds

  • Disable event-driven GitLab organization ingestion and rely on scheduled discovery until upgrading.
  • Enforce organization membership independently at the authenticating proxy or sign-in resolver.

Text from GitHub Advisory Database

Affected versions 4

  • @backstage/plugin-catalog-backend-module-gitlab, npm< 0.8.7GitHub
  • backstageaffected: < 1.54.6CVE List
  • plugin-catalog-backend-module-gitlabaffected: < 0.8.7CVE List
  • @backstage/plugin-catalog-backend-module-gitlab, npmfrom first release, fixed in 0.8.7OSV

References 5