CVE-2026-106562: Backstage has incorrect authorization in search engine permission filtering

October 7, 2026

An authenticated Backstage user subject to a DENY policy for search document types could receive search results they were not authorized to view. This affects deployments with permission.enabled: true and an Elasticsearch or OpenSearch search backend.

References

github.com/advisories/GHSA-9325-vq29-gp3v
github.com/backstage/backstage/commit/2d5d3e77d630455d6d48cfa8f31fd3c126fd6f29
github.com/backstage/backstage/releases/tag/v1.54.1
github.com/backstage/backstage/security/advisories/GHSA-9325-vq29-gp3v
nvd.nist.gov/vuln/detail/CVE-2026-106562

Code Behaviors & Features

Detect and mitigate CVE-2026-106562 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →