CVE-2026-106495Medium· 4.3▾ SunlitBackstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced. This issue is fixed in version 0.17.8.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-54412Medium· 6.5Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template
CVE-2024-33396High· 8.4An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component
CVE-2025-59422Low· 3.1Dify is an open-source LLM app development platform
CVE-2025-10957NoneThis vulnerability exists in the Syrotech SY-GPON-2010-WADONT router due to improper access control in its FTP service
CVE-2025-11352Medium· 6.3A security vulnerability has been detected in code-projects Online Hotel Reservation System 1.0
CVE-2025-11351Medium· 6.3A weakness has been identified in code-projects Online Hotel Reservation System 1.0