Vulnerability GHSA-3xr5-8w6c-p5gw
Medium Risk
MEDIUM RISK
CVSS Score: 4.3
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
5 hours ago
October 15, 2026 at 08:21 PM UTC
Backstage: Improper access control in backend action invocation
0.0.0-nightly-20220811024336 - 0.17.7
0.0.0-nightly-20220811024336 - 0.17.7
Summary
Backstage: Improper access control in backend action invocation
Details
Impact
An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced.
Patches
Patched in @backstage/backend-defaults version 0.17.8
Workarounds
Limit access to action invocation endpoints to trusted service callers until upgrading.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
8 days ago
Backstage: Cloud storage catalog locations may cross configured storage boundaries
0.0.0-nightly-20220811024336 - 0.17.7 GHSA-xvh9-35w9-42m4
0.0.0-nightly-20220811024336 - 0.17.7 GHSA-xvh9-35w9-42m4
High Risk
8 days ago
Backstage: Improper preservation of access restrictions during service credential delegation
0.0.0-nightly-20220811024336 - 0.17.7 GHSA-cq7v-rfgc-5c7v
0.0.0-nightly-20220811024336 - 0.17.7 GHSA-cq7v-rfgc-5c7v
Medium Risk
8 days ago
Backstage: Improper input validation in cloud storage URL readers
0.0.0-nightly-20220811024336 - 0.17.7 GHSA-7649-wm97-w3j3
0.0.0-nightly-20220811024336 - 0.17.7 GHSA-7649-wm97-w3j3
Low Risk
8 months ago
Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`
0.0.0-nightly-20220811024336 - 0.12.1 and 0.13.0 - 0.13.1 and 0.14.0 - 0.14.1-next.1 GHSA-q2x5-4xjx-c6p9
0.0.0-nightly-20220811024336 - 0.12.1 and 0.13.0 - 0.13.1 and 0.14.0 - 0.14.1-next.1 GHSA-q2x5-4xjx-c6p9
High Risk
8 months ago
Backstage has a Possible Symlink Path Traversal in Scaffolder Actions
0.0.0-nightly-20220811024336 - 0.12.1 and 0.13.0 - 0.13.1 and 0.14.0 - 0.14.1-next.1 GHSA-rq6q-wr2q-7pgp
0.0.0-nightly-20220811024336 - 0.12.1 and 0.13.0 - 0.13.1 and 0.14.0 - 0.14.1-next.1 GHSA-rq6q-wr2q-7pgp
Impacted packages
Timeline
Published
5 hours ago
October 15, 2026 at 08:21 PM UTC
Fixed (0.17.8)
1 month ago
August 28, 2026 at 08:18 AM UTC
Last Modified
5 hours ago
October 15, 2026 at 08:30 PM UTC