Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-106463: Backstage is an open framework for building developer portals

25
Routine
MEDIUM 5.4WATCHLISTUPGRADEUPGRADE

CVE-2026-106463 is a medium-severity flaw (CVSS 5.4) affecting backstage\/plugin-catalog-backend-module-gitlab, backstage. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthori

Why this priority

  • On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score5.4 (Medium)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededLow
User interactionNone
EPSS exploit chance0.2% (top 94%)
CISA exploited listNo
WeaknessCWE-863
Published2026-10-06
Last modified2026-10-22
Publisher (CNA): GitHub, Inc. · Vendor: linuxfoundation

Am I affected?

Timeline

linuxfoundation backstage\/plugin-catalog-backend-module-gitlab UPGRADE
Affected: < 0.8.7
Fixed in: 0.8.7
Safe to downgrade to: no unaffected older release
1. Check installed version
npm ls backstageplugin-catalog-backend-module-gitlab
2. UPGRADE to 0.8.7
npm install backstageplugin-catalog-backend-module-gitlab@">=0.8.7"
linuxfoundation backstage UPGRADE
Affected: < 1.54.6
Fixed in: 1.54.6
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy backstage || rpm -q backstage || backstage --version
2. UPGRADE to 1.54.6 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade backstage
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade backstage
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-106463?

backstage\/plugin-catalog-backend-module-gitlab: upgrade to 0.8.7; backstage: upgrade to 1.54.6. Exact commands for each OS are on this page.

Is CVE-2026-106463 being exploited?

CVE-2026-106463 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-106463 affect?

CVE-2026-106463 affects backstage\/plugin-catalog-backend-module-gitlab, backstage. Severity is medium (CVSS 5.4). Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enabl

How urgent is CVE-2026-106463?

Priority 25/100. On your watchlist

Software pages

GitLab vulnerabilities

References

← Back to latest CVEs