Orta CVSS 4.3
CVE-2026-106562: Backstage/plugin-search-backend: güvenlik açığı
Açıklama (NVD)
Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject to a DENY policy for search document types could receive unauthorized results in deployments with permission.enabled set to true and an Elasticsearch or OpenSearch backend. This issue is fixed in @backstage/plugin-search-backend 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch 1.8.7.
Özet bilgiler
- Ürün
- Linuxfoundation Backstage/plugin-search-backend
- CVSS v3.1
- 4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - EPSS
- %0,20 (yüzdelik 10)
- CWE
- CWE-754
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| linuxfoundation-backstage-plugin-search-backend | — | — | 2.1.6 |
| linuxfoundation-backstage-plugin-search-backend-module-elasticsearch | — | — | 1.8.7 |
| linuxfoundation-backstage | — | — | 1.54.1 |