PT-2026-38311 · Npm · @Backstage/Plugin-Catalog-Unprocessed-Entities+2

Benjdlambert · Published 2026-05-06 · Updated 2026-05-14 · CVE-2026-44374

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions @backstage/plugin-catalog-backend-module-unprocessed versions prior to 0.6.11 @backstage/plugin-catalog-unprocessed-entities-common versions prior to 0.0.15 @backstage/plugin-catalog-unprocessed-entities versions prior to 0.2.30

Description The unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. This allows any authenticated user to access unprocessed entity records regardless of ownership, leading to information disclosure.

Recommendations Update @backstage/plugin-catalog-backend-module-unprocessed to version 0.6.11. Update @backstage/plugin-catalog-unprocessed-entities-common to version 0.0.15. Update @backstage/plugin-catalog-unprocessed-entities to version 0.2.30. As a temporary workaround, remove the @backstage/plugin-catalog-backend-module-unprocessed module from the backend.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-44374

GHSA-P7G9-RP3G-MGFG

Affected Products

@Backstage/Plugin-Catalog-Backend-Module-Unprocessed

@Backstage/Plugin-Catalog-Unprocessed-Entities

@Backstage/Plugin-Catalog-Unprocessed-Entities-Common

References · 4

• https://github.com/backstage/backstage/security/advisories/GHSA-p7g9-rp3g-mgfg · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p7g9-rp3g-mgfg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44374 · Security Note
• https://github.com/backstage/backstage · Note