{"id":"CVE-2026-106495","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-106495","generatedAt":"2026-10-28T02:58:13.097Z","title":"Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation.","description":"Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced. This issue is fixed in version 0.17.8.","published":"2026-10-12T21:17:08.000Z","lastModified":"2026-10-16T16:00:34.000Z","status":"Awaiting Analysis","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},"cwe":["CWE-284"],"affected":[],"epss":{"score":0.00239,"percentile":0.14791,"date":"2026-10-26","history":[{"date":"2026-10-13","score":0.00238,"percentile":0.13773}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.24%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-12T21:17:08.000Z","detail":{"score":"4.3","severity":"MEDIUM","publishedAt":"2026-10-12T21:17:08.457Z"},"summary":"New CVE, medium severity (CVSS 4.3)."}],"references":[{"url":"https://github.com/backstage/backstage/commit/a8fb34a990a69bcb745e85a3213cf9e5ba2d31a3","source":"security-advisories@github.com"},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com"},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-3xr5-8w6c-p5gw","source":"security-advisories@github.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-106495","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}