https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-08T01:48:05.913190+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-106562 fkie_cve-2026-106562 2026-10-08T01:48:05.915290+00:00

Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject to a DENY policy for search document types could receive unauthorized results in deployments with permission.enabled set to true and an Elasticsearch or OpenSearch backend. This issue is fixed in @backstage/plugin-search-backend 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch 1.8.7.

 https://vulnerability.circl.lu/vuln/ghsa-9325-vq29-gp3v GHSA-9325-vq29-gp3v — Backstage has incorrect authorization in search engine permission filtering 2026-10-08T01:48:05.915375+00:00

Affected: npm: @backstage/plugin-search-backend, npm: @backstage/plugin-search-backend-module-elasticsearch

### Impact

An authenticated Backstage user subject to a `DENY` policy for search document types could receive search results they were not authorized to view. This affects deployments with `permission.enabled: true` and an Elasticsearch or OpenSearch search backend.

### Patches

- Upgrade `@backstage/plugin-search-backend` to 2.1.6 - Upgrade `@backstage/plugin-search-backend-module-elasticsearch` to 1.8.7

### Workarounds

If you are unable to upgrade immediately:

- Temporarily modify permission policies to use `CONDITIONAL` decisions with per-result filtering rather than blanket `DENY` for search document types - Restrict Elasticsearch/OpenSearch index access at the cluster level so that the search service account can only reach expected Backstage indices, limiting the blast radius if the authorization bypass is triggered.