---
id: CVE-2026-106495
title: Backstage is an open framework for building developer portals
summary: >-
  Backstage is an open framework for building developer portals. Prior to
  0.17.8, the @backstage/backend-defaults package is affected by improper access
  control in backend action invocation. An authenticated user could invoke
  actions that …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-284
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T21:17:08.457'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106495'
references:
  - url: >-
      https://github.com/backstage/backstage/commit/a8fb34a990a69bcb745e85a3213cf9e5ba2d31a3
    label: security-advisories@github.com
  - url: 'https://github.com/backstage/backstage/releases/tag/v1.54.6'
    label: security-advisories@github.com
  - url: >-
      https://github.com/backstage/backstage/security/advisories/GHSA-3xr5-8w6c-p5gw
    label: security-advisories@github.com
tags:
  - nvd
ingestedAt: '2026-10-12T22:05:40.352Z'
---

## Overview

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration. Existing action permissions and downstream authorization remain enforced. This issue is fixed in version 0.17.8.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.