CVE-2026-106463: Improper Authorization in @backstage/plugin-catalog-backend-module-gitlab
Summary
CVE-2026-106463: Backstage has improper authorization in GitLab organizational user ingestion. Affects @backstage/plugin-catalog-backend-module-gitlab versions < 0.8.7. Fixed in 0.8.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @backstage/plugin-catalog-backend-module-gitlab is a plugin for the Backstage platform that facilitates the ingestion of GitLab organizational events. This plugin allows users to manage and discover software components within their organization by integrating with GitLab's APIs. However, it has been found to have a vulnerability that can lead to unauthorized access due to improper authorization checks.
Vulnerability Detail
The vulnerability arises from the improper authorization in the GitLab organizational user ingestion process. Deployments that enable this feature and rely on scoped catalog users as an access boundary may inadvertently allow an unauthorized catalog identity to gain access. Depending on the sign-in and permission configurations, this could result in unauthorized access with the permissions of a standard authenticated user, potentially compromising sensitive information or functionalities.
How To Fix
Latest published version: 0.8.9 as of 23 Oct 2026
npm install @backstage/plugin-catalog-backend-module-gitlab@0.8.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.8.7
This is the first release that contains the fix.
npm install @backstage/plugin-catalog-backend-module-gitlab@0.8.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider disabling event-driven GitLab organization ingestion and instead rely on scheduled discovery until the upgrade is completed. Additionally, enforce organization membership independently at the authenticating proxy or sign-in resolver to mitigate risks.
Conclusion
The CVE-2026-106463 vulnerability in the @backstage/plugin-catalog-backend-module-gitlab poses a risk of unauthorized access due to improper authorization checks. It is crucial to upgrade to version 0.8.7 to mitigate this risk, and temporary workarounds are available if immediate upgrades are not possible.
See every vulnerability recorded for @backstage/plugin-catalog-backend-module-gitlab →
FAQ
CVE-2026-106463 is a vulnerability in the @backstage/plugin-catalog-backend-module-gitlab that allows unauthorized access due to improper authorization in GitLab organizational user ingestion.
If your application uses the affected version of the plugin and relies on scoped catalog users, it may allow unauthorized users to gain access to sensitive information or functionalities.
You can disable event-driven GitLab organization ingestion and use scheduled discovery as a temporary measure until you can upgrade to the patched version.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner without needing to sign up.
The CVSS score of this vulnerability is 5.4, indicating a moderate level of severity.
