The vulnerability is an improper access control issue in earlier Backstage releases, where authenticated users can invoke backend actions that an operator has explicitly excluded via action configuration. This permits unauthorized execution of backend actions; however, the permissions and downstream authorization mechanisms that apply to individual actions remain enforced, limiting the damage to the scope of those actions. As a result, an attacker could potentially trigger unintended behavior, but the impact is constrained to the enabled action permissions.

The affected products are the open-source Backstage developer portal and its bundled package @backstage/backend-defaults. Versions prior to 0.17.8 of this package are impacted. The issue is addressed in Backstage releases starting with v0.17.8 and also fixed in the later Backstage release v1.54.6, as indicated by the vendor's official changelog and version upgrade references.

The CVSS score of 4.3 indicates a moderate impact, and the EPSS score is currently unavailable, suggesting limited evidence of exploitation in the wild. This vulnerability is not listed in the CISA KEV catalog. Attackers require authentication; the best‑effort vector is an authenticated user exploiting a permissive action invocation path. The patch to upgrade to 0.17.8 or later removes the access control flaw, fully mitigating the issue.