Backstage, the open framework for building developer portals, contained an authorization flaw in the @backstage/plugin‑catalog‑backend‑module‑gitlab package before version 0.8.7. The bug allows deployments that enable GitLab organization event ingestion to create an unintended catalog identity. Depending on the sign‑in and permission configuration, this identity can act with the privileges of a normal authenticated user, potentially exposing data or resources that should remain restricted.

Any installation that uses the @backstage/plugin‑catalog‑backend‑module‑gitlab plugin prior to 0.8.7 and has GitLab organization event ingestion enabled is affected. These environments also rely on scoped catalog users as an access boundary and run within a Backstage instance that hosts the plugin.

The CVSS score of 5.4 classifies the flaw as medium severity. The EPSS score is less than 1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalogue. Exploitation requires an attacker to trigger or influence GitLab organization events processed by Backstage; thus, the risk is confined to systems that have that feature enabled. Once exploited, an attacker gains a catalog identity with standard user rights, which could be leveraged to read or modify portal content governed by Backstage permissions.