GHSA-hmp2-4m7g-22cv
Backstage: Scaffolder action input authorization bypass
At a glance
- Published
- Updated
- CVE
- CVE-2026-106503
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Description
### Impact An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. ### Patches Patched in `@backstage/plugin-scaffolder-backend` version `4.1.0` ### Workarounds - Restrict affected Scaffolder actions to trusted users and configure source-control integrations with least-privilege credentials.
Affected packages
| Package | Versions |
|---|---|
| npm · @backstage/plugin-scaffolder-backend | introduced 0, fixed 3.3.1 |
| npm · @backstage/plugin-scaffolder-backend | introduced 3.4.0, fixed 3.4.1 |
| npm · @backstage/plugin-scaffolder-backend | introduced 4.0.0, fixed 4.0.3 |
| npm · @backstage/plugin-scaffolder-backend | introduced 4.0.4, fixed 4.1.0 |
References
- https://github.com/backstage/backstage/security/advisories/GHSA-hmp2-4m7g-22cv WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-106503 ADVISORY
- https://github.com/backstage/backstage/commit/11c1384c0649b8ab26391c6a4e4f34b80ab0d188 WEB
- https://github.com/backstage/backstage/commit/a91ed72d540e80b62a73b39bb1563ff5018d52d1 WEB
- https://github.com/backstage/backstage/commit/e307e4f487103d815e484291b3fda778ab9983bf WEB
- https://github.com/backstage/backstage PACKAGE
- https://github.com/backstage/backstage/releases/tag/v1.49.6 WEB
- https://github.com/backstage/backstage/releases/tag/v1.50.5 WEB
- https://github.com/backstage/backstage/releases/tag/v1.54.6 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |