{"id":"EUVD-2026-93996","enisaUuid":"6461bb98-85ef-303b-bcc2-7280dd58a8c0","description":"Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment\u0027s permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified. This issue is fixed in version 4.1.0.","datePublished":"Oct 6, 2026, 8:25:32 PM","dateUpdated":"Oct 7, 2026, 4:23:06 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/backstage/backstage/security/advisories/GHSA-7hfw-grcm-cqm6\nhttps://github.com/backstage/backstage/commit/0253c50673f2832b0b1e9f73348186434e7bd09e\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","aliases":"CVE-2026-106461\nGHSA-7hfw-grcm-cqm6\n","assigner":"GitHub_M","epss":0.19,"enisaIdProduct":[{"id":"28121f50-2d39-3235-8905-2963299a189b","product":{"name":"plugin-scaffolder-backend","vendor":{"name":"@backstage"}},"product_version":"\u003c 4.1.0"},{"id":"2b5f0022-d028-385b-b2ce-fdbb47205d3b","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"\u003c 1.54.6"}],"enisaIdVendor":[{"id":"cca90f52-4eb4-38e7-80eb-1b63f2440baf","vendor":{"name":"backstage"}},{"id":"d84f51b1-e713-3cd1-b8ab-759d28110b24","vendor":{"name":"@backstage"}}],"enisaIdVulnerability":[{"id":"1bdc2518-7fc4-3d08-bb70-9ca647cfc80e","vulnerability":{"id":"CVE-2026-106461","description":"Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment\u0027s permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified. This issue is fixed in version 4.1.0.","datePublished":"Oct 6, 2026, 8:25:32 PM","dateUpdated":"Oct 7, 2026, 4:23:06 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/backstage/backstage/security/advisories/GHSA-7hfw-grcm-cqm6\nhttps://github.com/backstage/backstage/commit/0253c50673f2832b0b1e9f73348186434e7bd09e\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","enisa_id":"EUVD-2026-93996\n","assigner":"GitHub_M","epss":0.19,"dataProcessed":"Nov 6, 2026, 7:17:22 AM","vulnerabilityProduct":[{"id":"44d846fa-27d2-3bd7-9fa9-5710e4372797","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"\u003c 1.54.6"},{"id":"fb3ab1b0-8e92-30f2-9ca0-db5914647376","product":{"name":"plugin-scaffolder-backend","vendor":{"name":"@backstage"}},"product_version":"\u003c 4.1.0"}],"vulnerabilityVendor":[{"id":"b04a70ee-6318-35a2-9fd4-a310cbd0a80a","vendor":{"name":"backstage"}},{"id":"ce1082a4-9f9e-36a5-9153-b494c0c7d0dd","vendor":{"name":"@backstage"}}]}},{"id":"2400b9a7-ba14-3d30-bb5a-8479f68214d4","vulnerability":{"id":"GHSA-7hfw-grcm-cqm6","description":"Backstage: Incorrect authorization in scaffolder task listing","datePublished":"Oct 7, 2026, 5:58:55 PM","dateUpdated":"Oct 7, 2026, 5:58:55 PM","baseScore":0.0,"references":"https://github.com/backstage/backstage/security/advisories/GHSA-7hfw-grcm-cqm6\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106461\nhttps://github.com/backstage/backstage/commit/0253c50673f2832b0b1e9f73348186434e7bd09e\nhttps://github.com/backstage/backstage\nhttps://github.com/backstage/backstage/releases/tag/v1.54.6\n","enisa_id":"EUVD-2026-93996\n","aliases":"CVE-2026-106461\nGHSA-7hfw-grcm-cqm6\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}