{"id":"CVE-2026-106562","aliases":["GHSA-9325-vq29-gp3v"],"url":"https://o3.security/vulnerability/CVE-2026-106562","summary":"Backstage: Incorrect authorization in search engine permission filtering","details":"### Impact\n\nAn authenticated Backstage user subject to a `DENY` policy for search document types could receive search results they were not authorized to view. This affects deployments with `permission.enabled: true` and an Elasticsearch or OpenSearch search backend.\n\n### Patches\n\n- Upgrade `@backstage/plugin-search-backend` to 2.1.6\n- Upgrade `@backstage/plugin-search-backend-module-elasticsearch` to 1.8.7\n\n### Workarounds\n\nIf you are unable to upgrade immediately:\n\n- Temporarily modify permission policies to use `CONDITIONAL` decisions with per-result filtering rather than blanket `DENY` for search document types\n- Restrict Elasticsearch/OpenSearch index access at the cluster level so that the search service account can only reach expected Backstage indices, limiting the blast radius if the authorization bypass is triggered.","published":"2026-10-07T14:54:13.183Z","modified":"2026-10-21T02:54:35.493024622Z","cvss":{"score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"@backstage/plugin-search-backend","fixedVersion":"2.1.6"},{"ecosystem":"npm","name":"@backstage/plugin-search-backend-module-elasticsearch","fixedVersion":"1.8.7"}],"fix":{"url":"https://github.com/backstage/backstage/commit/2d5d3e77d630455d6d48cfa8f31fd3c126fd6f29","label":"backstage/backstage@2d5d3e7"},"references":[{"type":"WEB","url":"https://github.com/backstage/backstage/releases/tag/v1.54.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106562.json"},{"type":"ADVISORY","url":"https://github.com/backstage/backstage/security/advisories/GHSA-9325-vq29-gp3v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106562"},{"type":"FIX","url":"https://github.com/backstage/backstage/commit/2d5d3e77d630455d6d48cfa8f31fd3c126fd6f29"},{"type":"PACKAGE","url":"https://github.com/backstage/backstage"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:54:35.493024622Z"}}