CVE-2026-115923 | Backstage up to 3.9.1/4.0.1 DefaultCatalogRulesEnforcer location.target permission

October 26, 2026 Yanac

A vulnerability was found in Backstage up to 3.9.1/4.0.1. It has been rated as problematic. The impacted element is the function DefaultCatalogRulesEnforcer. The manipulation of the argument location.target leads to permission issues.

This vulnerability is uniquely identified as CVE-2026-115923. The attack is possible to be carried out remotely. No exploit exists.

Upgrading the affected component is advised.VulDB Recent EntriesRead More