This vulnerability results from insufficient URL validation during catalog entity placeholder resolution in Backstage. An authenticated user can craft a catalog entity with placeholder directives that reference resources outside the entity’s source repository. This allows the attacker to access data not intended to be available to that user, representing a breach of confidentiality and integrity. The weakness is classified as CWE-918 and CWE-863.

The affected products are Backstage’s core framework and its @backstage/plugin-catalog-backend module. All releases prior to v3.5.1, v3.6.2, v3.7.2, v3.8.2 and v3.9.1 are vulnerable; thus versions 3.5.0 and earlier, 3.6.1 and earlier, 3.7.1 and earlier, 3.8.1 and earlier, 3.9.0 and earlier are impacted. Upgrading to the corresponding fixed releases is required to remediate.

The CVSS score of 7.7 indicates a high severity vulnerability. No EPSS score is currently available, and the issue is not listed in CISA’s KEV catalog. Although the vulnerability requires authenticated access, the exploit path is straightforward: an attacker with permission to create catalog entities can embed malicious placeholder directives that resolve to external URLs, thereby retrieving data from outside the local repository. Because the attack does not depend on network-level exposure or third‑party services, the risk surface is primarily internal, but any misconfiguration that allows broad catalog creation permissions could be abused.