GHSA-p7g9-rp3g-mgfg
Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @backstage/plugin-catalog-unprocessed-entities-common | < 0.0.15 | 0.0.15 |
| npm | @backstage/plugin-catalog-unprocessed-entities | < 0.2.30 | 0.2.30 |
| npm | @backstage/plugin-catalog-backend-module-unprocessed | < 0.6.11 | 0.6.11 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
The unprocessed entities read endpoints in `@backstage/plugin-catalog-backend-module-unprocessed` do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This is
an information disclosure vulnerability affecting Backstage installations using this module.
### Patches
This is patched in `@backstage/plugin-catalog-backend-module-unprocessed` version 0.6.11, `@backstage/plugin-catalog-unprocessed-entities-common` version 0.0.15 and `@backstage/plugin-catalog-unprocessed-entities` version 0.2.30. Users should upgrade all packages.
### Workarounds
If users cannot upgrade, they can remove the `@backstage/plugin-catalog-backend-module-unprocessed` module from their backend until the patch is applied. There is no configuration-based workaround to add permission checks to these endpoints
without upgrading.
References
External links from the advisory. They lead to third-party sites.