CVE-2026-115923

MediumCVSS 6.5/10Last modified Nov 2, 2026

Description

Backstage is an open framework for building developer portals. Prior to 3.9.2 and from 4.0.0 until 4.0.2, DefaultCatalogRulesEnforcer in @backstage/plugin-catalog-backend compares the raw location.target URL against catalog.rules, while URL readers canonicalize the same URL before fetching it. An authenticated user with catalog.location.create permission can use percent-encoded path segments to make an untrusted URL match a trusted location pattern even though the canonical URL resolves outside that scope. This admits entity content from an untrusted source as trusted, while further downstream consequences depend on deployment configuration. This issue is fixed in versions 3.9.2 and 4.0.2.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
backstage	backstage	< 3.9.2; >= 4.0.0, < 4.0.2

References

Timeline

Published: Oct 26, 2026
Last modified: Nov 2, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1159248.6Rembg is a tool to remove images background. Prior to 2.0.82, the public /api/remove endpoint passes attacker-controlled extras.sam_model th CVE-2026-1159275.3Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by CVE-2026-1159287.5FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implement CVE-2026-1159296.8MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has t CVE-2026-1159306.8The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate sto CVE-2026-1159319.9Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functi CVE-2026-1159329.6When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that th CVE-2026-1159339.9Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route CVE-2026-1159349.8An unauthenticated SQL injection can occur on the front end of any site that uses craft.search to perform a search, allowing stacked query e CVE-2026-1159358.8The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admi CVE-2026-1159377.5The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * comm CVE-2026-1159388.8Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandbox