All vulnerabilities
CVE-2026-106562GHSA-9325-vq29-gp3v

@backstage/plugin-search-backend: Backstage has incorrect authorization in search engine permission filtering

backstage @backstage/plugin-search-backendnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
4.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.1.6Also 1.8.7GitHub
Published7 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

  • 2.1.6@backstage/plugin-search-backend, npmGitHubnpm install @backstage/plugin-search-backend@2.1.6
  • 1.8.7@backstage/plugin-search-backend-module-elasticsearch, npmGitHubnpm install @backstage/plugin-search-backend-module-elasticsearch@1.8.7

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

An authenticated Backstage user subject to a DENY policy for search document types could receive search results they were not authorized to view. This affects deployments with permission.enabled: true and an Elasticsearch or OpenSearch search backend.

Patches

  • Upgrade @backstage/plugin-search-backend to 2.1.6
  • Upgrade @backstage/plugin-search-backend-module-elasticsearch to 1.8.7

Workarounds

If you are unable to upgrade immediately:

  • Temporarily modify permission policies to use CONDITIONAL decisions with per-result filtering rather than blanket DENY for search document types
  • Restrict Elasticsearch/OpenSearch index access at the cluster level so that the search service account can only reach expected Backstage indices, limiting the blast radius if the authorization bypass is triggered.

Text from GitHub Advisory Database

Affected versions 7

  • @backstage/plugin-search-backend, npm< 2.1.6GitHub
  • @backstage/plugin-search-backend-module-elasticsearch, npm< 1.8.7GitHub
  • backstageaffected: < 1.54.1CVE List
  • plugin-search-backendaffected: < 2.1.6CVE List
  • plugin-search-backend-module-elasticsearchaffected: < 1.8.7CVE List
  • @backstage/plugin-search-backend, npmfrom first release, fixed in 2.1.6OSV
  • @backstage/plugin-search-backend-module-elasticsearch, npmfrom first release, fixed in 1.8.7OSV

References 5