CVE-2026-106562

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-106562", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-06T20:31:59.017Z", "datePublished": "2026-10-07T14:54:13.183Z", "dateUpdated": "2026-10-07T16:14:59.044Z"}, "containers": {"cna": {"title": "Backstage: Incorrect authorization in search engine permission filtering", "problemTypes": [{"descriptions": [{"cweId": "CWE-754", "lang": "en", "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/backstage/backstage/security/advisories/GHSA-9325-vq29-gp3v", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-9325-vq29-gp3v"}, {"name": "https://github.com/backstage/backstage/commit/2d5d3e77d630455d6d48cfa8f31fd3c126fd6f29", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/commit/2d5d3e77d630455d6d48cfa8f31fd3c126fd6f29"}, {"name": "https://github.com/backstage/backstage/releases/tag/v1.54.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/backstage/backstage/releases/tag/v1.54.1"}], "affected": [{"vendor": "backstage", "product": "backstage", "versions": [{"version": "< 1.54.1", "status": "affected"}]}, {"vendor": "@backstage", "product": "plugin-search-backend", "versions": [{"version": "< 2.1.6", "status": "affected"}]}, {"vendor": "@backstage", "product": "plugin-search-backend-module-elasticsearch", "versions": [{"version": "< 1.8.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-07T14:54:13.183Z"}, "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject to a DENY policy for search document types could receive unauthorized results in deployments with permission.enabled set to true and an Elasticsearch or OpenSearch backend. This issue is fixed in @backstage/plugin-search-backend 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch 1.8.7."}], "source": {"advisory": "GHSA-9325-vq29-gp3v", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-07T16:14:40.675570Z", "id": "CVE-2026-106562", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T16:14:59.044Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-106562", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-07T16:14:40.675570Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T16:14:49.959Z"}}], "cna": {"title": "Backstage: Incorrect authorization in search engine permission filtering", "source": {"advisory": "GHSA-9325-vq29-gp3v", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "backstage", "product": "backstage", "versions": [{"status": "affected", "version": "< 1.54.1"}]}, {"vendor": "@backstage", "product": "plugin-search-backend", "versions": [{"status": "affected", "version": "< 2.1.6"}]}, {"vendor": "@backstage", "product": "plugin-search-backend-module-elasticsearch", "versions": [{"status": "affected", "version": "< 1.8.7"}]}], "references": [{"url": "https://github.com/backstage/backstage/security/advisories/GHSA-9325-vq29-gp3v", "name": "https://github.com/backstage/backstage/security/advisories/GHSA-9325-vq29-gp3v", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/backstage/backstage/commit/2d5d3e77d630455d6d48cfa8f31fd3c126fd6f29", "name": "https://github.com/backstage/backstage/commit/2d5d3e77d630455d6d48cfa8f31fd3c126fd6f29", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/backstage/backstage/releases/tag/v1.54.1", "name": "https://github.com/backstage/backstage/releases/tag/v1.54.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject to a DENY policy for search document types could receive unauthorized results in deployments with permission.enabled set to true and an Elasticsearch or OpenSearch backend. This issue is fixed in @backstage/plugin-search-backend 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch 1.8.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-754", "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-07T14:54:13.183Z"}}}, "cveMetadata": {"cveId": "CVE-2026-106562", "state": "PUBLISHED", "dateUpdated": "2026-10-07T16:14:59.044Z", "dateReserved": "2026-10-06T20:31:59.017Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-07T14:54:13.183Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "backstage", "vendor": "backstage", "versions": [{"status": "affected", "version": "< 1.54.1"}]}, {"product": "plugin-search-backend", "vendor": "@backstage", "versions": [{"status": "affected", "version": "< 2.1.6"}]}, {"product": "plugin-search-backend-module-elasticsearch", "vendor": "@backstage", "versions": [{"status": "affected", "version": "< 1.8.7"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:backstage\\/plugin-search-backend:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "9D2D3744-3735-46FD-843E-967DBD15C55F", "versionEndExcluding": "2.1.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:backstage\\/plugin-search-backend-module-elasticsearch:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "5904D752-0347-4BE4-B9ED-615C9252BB41", "versionEndExcluding": "1.8.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*", "matchCriteriaId": "C8A1DF85-5DDB-4468-8447-2149B81037E4", "versionEndExcluding": "1.54.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject to a DENY policy for search document types could receive unauthorized results in deployments with permission.enabled set to true and an Elasticsearch or OpenSearch backend. This issue is fixed in @backstage/plugin-search-backend 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch 1.8.7."}], "id": "CVE-2026-106562", "lastModified": "2026-10-16T14:53:52.520", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-106562", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-07T16:14:40.675570Z", "version": "2.0.3"}}]}, "published": "2026-10-07T15:17:17.677", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/backstage/backstage/commit/2d5d3e77d630455d6d48cfa8f31fd3c126fd6f29"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/backstage/backstage/releases/tag/v1.54.1"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/backstage/backstage/security/advisories/GHSA-9325-vq29-gp3v"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-754"}, {"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "plugin-search-backend: plugin-search-backend-module-elasticsearch: Backstage: Information disclosure via search permission filter bypass", "id": "2547513", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547513"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-201", "details": ["A flaw was found in Backstage search backend plugins. In deployments configured with permission enforcement and backed by an Elasticsearch or OpenSearch service, search engine filtering fails to properly apply document denial policies. An authenticated user can exploit this issue during search queries to retrieve restricted documents, resulting in unauthorized information disclosure."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-106562", "package_state": [{"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform/automation-portal", "product_name": "Self-service automation portal 2"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform/bootc-automation-portal-rhel9", "product_name": "Self-service automation portal 2"}], "public_date": "2026-10-07T14:54:13Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-106562\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106562\nhttps://github.com/backstage/backstage/commit/2d5d3e77d630455d6d48cfa8f31fd3c126fd6f29\nhttps://github.com/backstage/backstage/releases/tag/v1.54.1\nhttps://github.com/backstage/backstage/security/advisories/GHSA-9325-vq29-gp3v"], "statement": "This vulnerability is rated as Moderate because exploitation requires authenticated user credentials and specific environment configurations, specifically having authorization policies enabled alongside Elasticsearch or OpenSearch search indexing. In affected deployments, such as Red Hat Developer Hub or Ansible Automation Platform, an authenticated user restricted by access policies may view search records that should otherwise be withheld. The flaw only leads to limited information disclosure without granting privilege escalation or system modification capabilities.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.54.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "backstage", "source": "cna", "vendor": "backstage"}, "product": "backstage", "vendor": "backstage"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.1.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "plugin-search-backend", "vendor": "backstage"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.8.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "plugin-search-backend-module-elasticsearch", "source": "cna", "vendor": "@backstage"}, "product": "plugin-search-backend-module-elasticsearch", "vendor": "backstage"}], "created": "2026-10-07T16:45:08.607242+00:00", "updated": "2026-10-11T12:27:58.409409+00:00", "vendors": ["backstage", "backstage$PRODUCT$backstage", "backstage$PRODUCT$plugin-search-backend", "backstage$PRODUCT$plugin-search-backend-module-elasticsearch"], "weaknesses": ["CWE-201", "CWE-754", "CWE-863"]}