{"id":"CVE-2026-106503","published":"2026-10-06T22:17:05.513","lastModified":"2026-10-09T02:17:00.807","description":"Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-178","CWE-284"],"vendors":[],"products":[],"references":[{"url":"https://github.com/backstage/backstage/commit/11c1384c0649b8ab26391c6a4e4f34b80ab0d188","tags":[]},{"url":"https://github.com/backstage/backstage/commit/a91ed72d540e80b62a73b39bb1563ff5018d52d1","tags":[]},{"url":"https://github.com/backstage/backstage/commit/e307e4f487103d815e484291b3fda778ab9983bf","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.49.6","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.50.5","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","tags":[]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-hmp2-4m7g-22cv","tags":[]}],"exploitRefs":[{"url":"https://github.com/backstage/backstage/commit/11c1384c0649b8ab26391c6a4e4f34b80ab0d188","tags":[]},{"url":"https://github.com/backstage/backstage/commit/a91ed72d540e80b62a73b39bb1563ff5018d52d1","tags":[]},{"url":"https://github.com/backstage/backstage/commit/e307e4f487103d815e484291b3fda778ab9983bf","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.49.6","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.50.5","tags":[]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","tags":[]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-hmp2-4m7g-22cv","tags":[]}],"hasPoc":true,"ai":{"summary":"An authenticated user can bypass authorization controls on Scaffolder templates in Backstage, potentially gaining unauthorized access to source control resources. This vulnerability allows attackers to execute restricted scaffolder actions they shouldn't be able to perform.","exploitability":"The exploit requires an authenticated user with access to affected Scaffolder templates, making it moderately difficult to exploit but not highly complex.","blast_radius":"If exploited, this could allow unauthorized access to repositories and source-control resources, potentially leading to code injection, data exfiltration, or privilege escalation within the development environment.","remediation":"Upgrade to version 3.3.1, 3.4.1, 4.0.3, or 4.1.0 of the @backstage/plugin-scaffolder-backend package.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","scaffolder","developer-tools","backstage"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:57:41.080Z"}}