Backstage: Scaffolder action input authorization bypass
### Impact An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. ### Patches Patched in `@backstage/plugin-scaffolder-backend` version `4.1.0` ### Workarounds - Restrict affected Scaffolder actions to trusted users and configure source-control integrations with least-privilege credentials.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-106503US | — | — | ||
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder ac… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/backstage/backstagePACKAGE
- https://github.com/backstage/backstage/commit/11c1384c0649b8ab26391c6a4e4f34b80ab0d188WEB
- https://github.com/backstage/backstage/commit/a91ed72d540e80b62a73b39bb1563ff5018d52d1WEB
- https://github.com/backstage/backstage/commit/e307e4f487103d815e484291b3fda778ab9983bfWEB
- https://github.com/backstage/backstage/releases/tag/v1.49.6WEB
- https://github.com/backstage/backstage/releases/tag/v1.50.5WEB
- https://github.com/backstage/backstage/releases/tag/v1.54.6WEB
- https://github.com/backstage/backstage/security/advisories/GHSA-hmp2-4m7g-22cvWEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan