CVE-2026-106503 · GHSA-hmp2-4m7g-22cv
Backstage: Scaffolder action input authorization bypass
- Risk score
- 60/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 6 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected Scaffolder templates could bypass configured action restrict…
- Affected
- @backstage/plugin-scaffolder-backend (npm) < 3.3.1; @backstage/plugin-scaffolder-backend (npm) >= 3.4.0, < 3.4.1; @backstage/plugin-scaffolder-backend (npm) >= 4.0.0, < 4.0.3; @backstage/plugin-scaffolder-backend (npm) >= 4.0.4, < 4.1.0
- Fix
- Upgrade @backstage/plugin-scaffolder-backend to 3.3.1 or 3.4.1 or 4.0.3 or 4.1.0 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
@backstage/plugin-scaffolder-backend: Amber, patch this week. Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution…
The flaws
- CVE-2026-106503: Backstage: Scaffolder action input authorization bypass (CVSS 8.1 · EPSS 0%)
- CVE-2026-106501: Backstage: Sensitive information exposure in Scaffolder (CVSS 9.6 · EPSS 0%)
- CVE-2026-106500: Backstage: Improper task state validation in Scaffolder backend (CVSS 8.5 · EPSS 0%)
- CVE-2026-106462: Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback (CVSS 6.4 · EPSS 0%)
The fix
Upgrade @backstage/plugin-scaffolder-backend: 3.3.1 · 3.4.1 · 4.0.3 · 4.1.0 · 1.54.6 or later on your release line
Who is exposed: @backstage/plugin-scaffolder-backend (npm) < 3.3.1; @backstage/plugin-scaffolder-backend (npm) >= 3.4.0, < 3.4.1; @backstage/plugin-scaffolder-backend (npm) >= 4.0.0, < 4.0.3; @backstage/plugin-scaffolder-backend (npm) >= 4.0.4, < 4.1.0
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-178 (CWE-178). 16 other warnings in 30 days
- Same product: Earlier @backstage/plugin-scaffolder-backend warnings. 5 in the last 90 days
Why it is Yellow
- CVSS 8.1 high
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| @backstage/plugin-scaffolder-backend | npm | < 3.3.1 | 3.3.1 |
| @backstage/plugin-scaffolder-backend | npm | >= 3.4.0, < 3.4.1 | 3.4.1 |
| @backstage/plugin-scaffolder-backend | npm | >= 4.0.0, < 4.0.3 | 4.0.3 |
| @backstage/plugin-scaffolder-backend | npm | >= 4.0.4, < 4.1.0 | 4.1.0 |
References
- https://github.com/advisories/GHSA-hmp2-4m7g-22cv
- https://github.com/backstage/backstage/security/advisories/GHSA-hmp2-4m7g-22cv
- https://nvd.nist.gov/vuln/detail/CVE-2026-106503
- https://github.com/backstage/backstage/commit/11c1384c0649b8ab26391c6a4e4f34b80ab0d188
- https://github.com/backstage/backstage/commit/a91ed72d540e80b62a73b39bb1563ff5018d52d1
- https://github.com/backstage/backstage/commit/e307e4f487103d815e484291b3fda778ab9983bf
- https://github.com/backstage/backstage/releases/tag/v1.49.6
- https://github.com/backstage/backstage/releases/tag/v1.50.5
- https://github.com/backstage/backstage/releases/tag/v1.54.6
- https://github.com/advisories/GHSA-hmp2-4m7g-22cv
Original description
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.
Last activity 6 Oct 2026. Patch Forecast updates every hour.