High severity · published Oct 6, 2026
CVE-2026-106503
Backstage: Scaffolder action input authorization bypass
8.1
CVSS
0.4%
EPSS
No
On KEV
Description
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
backstage · backstage
< 1.49.6; >= 1.50.0-next.0, < 1.50.5; >= 1.51.0-next.0, < 1.54.6 · source: vendor, NVD
PL
plugin-scaffolder-backend · @backstage
< 3.3.1; >= 3.4.0, < 3.4.1; >= 4.0.0, < 4.0.3; >= 4.0.4, < 4.1.0 · source: vendor
BA
Backstage/plugin-scaffolder-backend · Linuxfoundation
before 3.3.1; 3.4.0 before 3.4.1; 4.0.0 before 4.0.3; 4.0.4 before 4.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-106503
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-106503
x_refsource_CONFIRM
https://github.com/backstage/backstage/security/advisories/GHSA-hmp2-4m7g-22cv
x_refsource_MISC
https://github.com/backstage/backstage/commit/11c1384c0649b8ab26391c6a4e4f34b80ab0d188
x_refsource_MISC
https://github.com/backstage/backstage/commit/a91ed72d540e80b62a73b39bb1563ff5018d52d1
x_refsource_MISC
https://github.com/backstage/backstage/commit/e307e4f487103d815e484291b3fda778ab9983bf
x_refsource_MISC
https://github.com/backstage/backstage/releases/tag/v1.49.6
x_refsource_MISC
https://github.com/backstage/backstage/releases/tag/v1.50.5
More from plugin-scaffolder-backend
9.6
CVE-2026-106501
Backstage: Sensitive information exposure in Scaffolder
8.5
CVE-2026-106500
Backstage: Improper task state validation in Scaffolder backend
6.5
CVE-2026-106504
Backstage: Sensitive information exposure in scaffolder task logs
6.4
CVE-2026-106462
Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback
5.3
CVE-2026-106506
Backstage: Improper input validation in scaffolder task list ordering