Threats tagged 'ghsa-9325-vq29-gp3v'

1 threat

Threats tagged 'ghsa-9325-vq29-gp3v'
Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	4.3	EPSS 0.2%	CVE-2026-106562@backstage/plugin-search-backend · Plugin search backend: Backstage has incorrect authorization in search engine permission filtering (CVE-2026-106562) Medium4.3EPSS 0.2%2026-10-07GCVE DatabaseCVE-2026-106562 An authorization bypass vulnerability exists in the Backstage plugin search backend when permission filtering is enabled and using Elasticsearch or OpenSearch. Authenticated users subject to a DENY policy for certain search document types may receive unauthorized search results. This affects versions of @backstage/plugin-search-backend prior to 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch prior to 1.8.7. A fix is available in these versions. EPSS 0.2%Vulnerability #ghsa-9325-vq29-gp3v #npm	GCVE Database	2026-10-07

Showing 1–1 of 1 result