backstage plugin-catalog-backend-module-unprocessed vulnerabilities

Latest backstage plugin-catalog-backend-module-unprocessed CVEs

Newest publication first

1. CVE-2026-44374 Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks

   Published 2026-05-14

   Medium·CVSS 4.3 EPSS 0.17%

   Backstage is an open framework for building developer portals. Prior to 0.6.11, the unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity rec...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.