{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "@backstage plugin-search-backend: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/backstage--plugin-search-backend/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/backstage--plugin-search-backend/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-106562/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-106562/",
   "title": "CVE-2026-106562 · backstage · disclosed",
   "content_text": "Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject to a DENY policy for search document types could receive unauthorized results in deployments with permission.enabled set to true and an Elasticsearch or OpenSearch backend. This issue is fixed in @backstage/plugin-search-backend 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch 1.8.7.",
   "date_published": "2026-10-07T14:54:13Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-106562/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-106562/",
   "title": "CVE-2026-106562 · backstage · fixed upstream (npm)",
   "content_text": "Fixed versions: @backstage/plugin-search-backend 2.1.6, @backstage/plugin-search-backend-module-elasticsearch 1.8.7.",
   "date_published": "2026-10-07T14:54:13Z"
  }
 ]
}