Disclosure summary
### Impact An authenticated Backstage user subject to a `DENY` policy for search document types could receive search results they were not authorized to view. This affects deployments with `permission.enabled: true` and an Elasticsearch or OpenSearch search backend. ### Patches - Upgrade `@backstage/plugin-search-backend` to 2.1.6 - Upgrade `@backstage/plugin-search-backend-module-elasticsearch` to 1.8.7 ### Workarounds If you are unable to upgrade immediately: - Temporarily modify permission policies to use `CONDITIONAL` decisions with per-result filtering rather than blanket `DENY` for search document types - Restrict Elasticsearch/OpenSearch index access at the cluster level so that the search service account can only reach expected Backstage indices, limiting the blast radius if the authorization bypass is triggered.
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
GitHub Reviewed Security Advisories · GHSA-9325-vq29-gp3v
Open original source · Updated Oct 07, 2026
Backstage has incorrect authorization in search engine permission filtering
Source severity: MEDIUM / 0
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| npm | @backstage/plugin-search-backend | < 2.1.6 | 2.1.6 |
| npm | @backstage/plugin-search-backend-module-elasticsearch | < 1.8.7 | 1.8.7 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Reviewed advisory
PUBLISHED 2026-10-07T14:02:52-04:00
MODIFIED 2026-10-07T14:02:54-04:00
INGESTED 2026-10-08T12:30:38-04:00