CVE-2026-106488

Summary

The flaw allows authenticated OIDC users to impersonate other catalog identities when email-based identity resolution is used with unverified emails, potentially granting unauthorized access to user permissions and data. This is a privilege escalation issue in the authentication system.

Exploitability

Exploitation requires an authenticated OIDC session with a provider that allows unverified emails, and the attacker must know or guess another user's email address to impersonate them, making it moderately difficult but not highly complex.

Blast radius

The impact could be significant across all Backstage deployments using OIDC with email-based identity resolution, potentially allowing attackers to access sensitive project data, permissions, and catalog resources as other users.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.4.20 or later to fix the improper authentication in the OIDC provider.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.