Backstage: Scaffolder action input authorization bypass
### Impact An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. ### Patches Patched in `@backstage/plugin-scaffolder-backend` version `4.1.0` ### Workarounds - Restrict affected Scaffolder actions to trusted users and configure source-control integrations with least-privilege credentials.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-106503US | — | — | ||
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder ac… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/backstage/backstagePACKAGE
- https://github.com/backstage/backstage/commit/11c1384c0649b8ab26391c6a4e4f34b80ab0d188WEB
- https://github.com/backstage/backstage/commit/a91ed72d540e80b62a73b39bb1563ff5018d52d1WEB
- https://github.com/backstage/backstage/commit/e307e4f487103d815e484291b3fda778ab9983bfWEB
- https://github.com/backstage/backstage/releases/tag/v1.49.6WEB
- https://github.com/backstage/backstage/releases/tag/v1.50.5WEB
- https://github.com/backstage/backstage/releases/tag/v1.54.6WEB
- https://github.com/backstage/backstage/security/advisories/GHSA-hmp2-4m7g-22cvWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan