The vulnerability arises from inconsistent evaluation of catalog property permissions in Backstage’s @backstage/plugin-catalog-backend, enabling an authenticated user to obtain catalog entity data that a policy was intended to restrict. This results in a confidentiality breach without affecting integrity or availability.

Backstage deployments that use the @backstage/plugin-catalog-backend package prior to version 3.9.1 are impacted. All versions of the core Backstage application before 3.9.1 that employ value‑based catalog permission conditions expose sensitive catalog entities to authenticated users.

With a CVSS score of 4.3, the risk is moderate; the EPSS score of < 1% indicates an extremely low probability of exploitation and the vulnerability is not listed in CISA’s KEV. Exploitation requires a valid authenticated account and the use of value‑based permission checks that rely on the affected catalog property. Attackers who can log in to Backstage can view catalog entities they were not authorized to see, potentially revealing confidential project information. Because the flaw is confined to the application’s permission engine, the vector is local to the Backstage service, but the impact is that confidential catalog data may be disclosed to unintended users.