CVE-2026-106562: Backstage has incorrect authorization in search engine permission filtering

October 7, 2026

An authenticated Backstage user subject to a DENY policy for search document types could receive search results they were not authorized to view. This affects deployments with permission.enabled: true and an Elasticsearch or OpenSearch search backend.

References

github.com/advisories/GHSA-9325-vq29-gp3v
github.com/backstage/backstage/commit/2d5d3e77d630455d6d48cfa8f31fd3c126fd6f29
github.com/backstage/backstage/releases/tag/v1.54.1
github.com/backstage/backstage/security/advisories/GHSA-9325-vq29-gp3v
nvd.nist.gov/vuln/detail/CVE-2026-106562

Code Behaviors & Features

Detect and mitigate CVE-2026-106562 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →