CVE-2026-44374

3 advisories.

npm/@backstage/plugin-catalog-unprocessed-entities-common CVE-2026-44374: medium 4.3, EPSS 0.28%

Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks

Action: Upgrade @backstage/plugin-catalog-unprocessed-entities-common to 0.0.15 or later.

npm i @backstage/plugin-catalog-unprocessed-entities-common@0.0.15

introduced	fixed	last affected
0	0.0.15	-

0.0.15

CVE-2026-44374 · published 2026-05-06T23:04:07Z · modified 2026-05-14T21:03:41.658932Z · JSON

Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks

Action: Upgrade @backstage/plugin-catalog-unprocessed-entities to 0.2.30 or later.

npm i @backstage/plugin-catalog-unprocessed-entities@0.2.30

introduced	fixed	last affected
0	0.2.30	-

0.2.30

CVE-2026-44374 · published 2026-05-06T23:04:07Z · modified 2026-05-14T21:03:41.658932Z · JSON

Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks

Action: Upgrade @backstage/plugin-catalog-backend-module-unprocessed to 0.6.11 or later.

npm i @backstage/plugin-catalog-backend-module-unprocessed@0.6.11

introduced	fixed	last affected
0	0.6.11	-

0.6.11

CVE-2026-44374 · published 2026-05-06T23:04:07Z · modified 2026-05-14T21:03:41.658932Z · JSON