{"id":"CVE-2026-106500","published":"2026-10-06T22:17:05.060","lastModified":"2026-10-07T16:17:39.567","description":"Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper task state validation in scaffolder backend. An authenticated user with permission to create and access Scaffolder tasks may, under specific timing and deployment conditions, affect files accessible to the Backstage backend. If backend application files are writable, the confidentiality, integrity, and availability of the backend may be compromised. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-59","CWE-362"],"vendors":[],"products":[],"references":[{"url":"https://github.com/backstage/backstage/commit/0d24f1b8701f3dde6cd597f81997c1ea873a43ae","tags":[]},{"url":"https://github.com/backstage/backstage/commit/56be299dd3ef6706e13e76ea2f8a9b0dd0b6413d","tags":[]},{"url":"https://github.com/backstage/backstage/commit/9e86c95a1a3ddfd54db03731cd8678aa63495175","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.49.6","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.50.5","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","tags":[]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-xvgh-hmx8-9xxf","tags":[]}],"exploitRefs":[{"url":"https://github.com/backstage/backstage/commit/0d24f1b8701f3dde6cd597f81997c1ea873a43ae","tags":[]},{"url":"https://github.com/backstage/backstage/commit/56be299dd3ef6706e13e76ea2f8a9b0dd0b6413d","tags":[]},{"url":"https://github.com/backstage/backstage/commit/9e86c95a1a3ddfd54db03731cd8678aa63495175","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.49.6","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.50.5","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","tags":[]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-xvgh-hmx8-9xxf","tags":[]}],"hasPoc":true,"ai":{"summary":"The Backstage scaffolder backend has a flaw in task state validation that allows authenticated users to potentially access and modify backend application files under specific conditions. This could lead to compromise of confidentiality, integrity, and availability of the backend system.","exploitability":"Exploitation requires an authenticated user with scaffolder task permissions and specific deployment timing conditions, making it moderately difficult but not highly complex to achieve.","blast_radius":"If exploited, this vulnerability could allow attackers to modify backend application files, potentially leading to complete backend compromise including code execution and data breaches.","remediation":"Upgrade to Backstage versions 3.3.1, 3.4.1, 4.0.3, or 4.1.0 where this vulnerability is fixed.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","file-access","backend","scaffolder"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:54:04.094Z"}}