{"id":"CVE-2026-106503","sourceIdentifier":"security-advisories@github.com","published":"2026-10-06T22:17:05.513","lastModified":"2026-10-13T14:37:56.910","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"backstage","product":"backstage","versions":[{"version":"< 1.49.6","status":"affected"},{"version":">= 1.50.0-next.0, < 1.50.5","status":"affected"},{"version":">= 1.51.0-next.0, < 1.54.6","status":"affected"}]},{"vendor":"@backstage","product":"plugin-scaffolder-backend","versions":[{"version":"< 3.3.1","status":"affected"},{"version":">= 3.4.0, < 3.4.1","status":"affected"},{"version":">= 4.0.0, < 4.0.3","status":"affected"},{"version":">= 4.0.4, < 4.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-09T01:55:45.447568Z","id":"CVE-2026-106503","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-178"},{"lang":"en","value":"CWE-284"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*","versionEndExcluding":"3.3.1","matchCriteriaId":"1E40C96F-E2DC-4066-8F97-A2A0E669075E"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*","versionStartIncluding":"3.4.0","versionEndExcluding":"3.4.1","matchCriteriaId":"E52510C2-B9A3-4309-9CD6-537E7F142C00"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.3","matchCriteriaId":"FE34FC94-86CE-48AE-8E79-C5E5C4FB5FE9"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage\\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.4","versionEndExcluding":"4.1.0","matchCriteriaId":"E42114C6-ECBB-46A3-BB2B-BF154CA7D7B1"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionEndExcluding":"1.49.6","matchCriteriaId":"8D095FA7-D58D-4B37-84B2-0E565FF215C1"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionStartIncluding":"1.50.0","versionEndExcluding":"1.50.5","matchCriteriaId":"DC5B9818-20D9-4507-80D2-6242DED888AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*","versionStartIncluding":"1.51.0","versionEndExcluding":"1.54.6","matchCriteriaId":"C8071EEF-6BEF-4AC1-B333-CCFC0FFFA72E"}]}]}],"references":[{"url":"https://github.com/backstage/backstage/commit/11c1384c0649b8ab26391c6a4e4f34b80ab0d188","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/commit/a91ed72d540e80b62a73b39bb1563ff5018d52d1","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/commit/e307e4f487103d815e484291b3fda778ab9983bf","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.49.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.50.5","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/releases/tag/v1.54.6","source":"security-advisories@github.com","tags":["Patch","Release Notes"]},{"url":"https://github.com/backstage/backstage/security/advisories/GHSA-hmp2-4m7g-22cv","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}