Plugin catalog backend module gitlab: Backstage has improper authorization in GitLab organizational user ingestion (CVE-2026-106463)

The @backstage/plugin-catalog-backend-module-gitlab before version 0.8.7 has an improper authorization vulnerability (CVE-2026-106463) in the GitLab organizational user ingestion process. Deployments that enable GitLab organization event ingestion and rely on scoped catalog users for access control may inadvertently admit an unintended catalog identity. Depending on sign-in and permission configurations, this could allow unauthorized access with standard authenticated user permissions. The vulnerability is addressed by upgrading to version 0.8.7.

Unauthorized users may gain access with the permissions of a standard authenticated user due to improper authorization in the GitLab organization event ingestion process. This could lead to unauthorized access to catalog identities within affected deployments. The impact is limited to the permissions of a standard authenticated user and does not include elevated privileges beyond that scope.

Upgrade the @backstage/plugin-catalog-backend-module-gitlab package to version 0.8.7 or later to remediate this vulnerability. As a temporary workaround before upgrading, disable event-driven GitLab organization ingestion and rely on scheduled discovery. Additionally, enforce organization membership checks independently at the authenticating proxy or sign-in resolver.