Backend defaults: Backstage: Improper access control in backend action invocation (CVE-2026-106495)

CVE-2026-106495 describes an improper access control vulnerability in the @backstage/backend-defaults package. Specifically, an authenticated user could invoke backend actions that an operator had explicitly excluded via action configuration. Despite this, existing action permissions and downstream authorization mechanisms continue to be enforced, limiting the scope of unauthorized access. The vulnerability affects all versions prior to 0.17.8 and was addressed in the 0.17.8 release.

The vulnerability allows an authenticated user to invoke backend actions that should have been excluded by configuration, potentially leading to unauthorized action execution. However, since existing permissions and downstream authorization remain enforced, the impact is limited to bypassing action exclusion configurations without elevating privileges beyond the user's existing permissions. There is no confidentiality or availability impact reported.

Upgrade to @backstage/backend-defaults version 0.17.8 or later, where this vulnerability is patched. Until the upgrade can be applied, restrict access to action invocation endpoints to trusted service callers to prevent unauthorized invocation of excluded actions.