CVE-2026-106463: Backstage has improper authorization in GitLab organizational user ingestion

October 7, 2026

Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthorized access with the permissions of a standard authenticated user.

References

github.com/advisories/GHSA-gp6m-x9vw-5c5x
github.com/backstage/backstage/commit/c211b4b67d28efd2f4fac63e35e2ac515e305cb3
github.com/backstage/backstage/releases/tag/v1.54.6
github.com/backstage/backstage/security/advisories/GHSA-gp6m-x9vw-5c5x
nvd.nist.gov/vuln/detail/CVE-2026-106463

Code Behaviors & Features

Detect and mitigate CVE-2026-106463 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →