npm/@backstage/plugin-search-backend-module-elasticsearch CVE-2026-106562: medium 4.3, EPSS 0.20%

Backstage has incorrect authorization in search engine permission filtering

Action: Upgrade @backstage/plugin-search-backend-module-elasticsearch to 1.8.7 or later.

npm i @backstage/plugin-search-backend-module-elasticsearch@1.8.7

Affected

Fixed versions

Sources

• osv: GHSA-9325-vq29-gp3v#npm/@backstage/plugin-search-backend-module-elasticsearch
• https://github.com/backstage/backstage/security/advisories/GHSA-9325-vq29-gp3v
• https://nvd.nist.gov/vuln/detail/CVE-2026-106562
• https://github.com/backstage/backstage/commit/2d5d3e77d630455d6d48cfa8f31fd3c126fd6f29
• https://github.com/backstage/backstage
• https://github.com/backstage/backstage/releases/tag/v1.54.1

CVE-2026-106562 · published 2026-10-07T18:02:52Z · modified 2026-10-07T18:15:11.183397966Z · JSON