VulnerabilityAnalyzed

CVE-2026-106503

Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass.

HIGH 8.1EPSS 0.39%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.39%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.

CVSS 3.1: 8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS: 0.39% probability · 33th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-178, CWE-284
Affected: linuxfoundation/backstage\/plugin-scaffolder-backend · linuxfoundation/backstage
Source: security-advisories@github.com

EPSS trend

EPSS moved from 0.4% on 7 October 2026 to 0.4% on 26 October 2026.

References

https://github.com/backstage/backstage/commit/11c1384c0649b8ab26391c6a4e4f34b80ab0d188Patch
https://github.com/backstage/backstage/commit/a91ed72d540e80b62a73b39bb1563ff5018d52d1Patch
https://github.com/backstage/backstage/commit/e307e4f487103d815e484291b3fda778ab9983bfPatch
https://github.com/backstage/backstage/releases/tag/v1.49.6Patch, Release Notes
https://github.com/backstage/backstage/releases/tag/v1.50.5Patch, Release Notes
https://github.com/backstage/backstage/releases/tag/v1.54.6Patch, Release Notes
https://github.com/backstage/backstage/security/advisories/GHSA-hmp2-4m7g-22cvMitigation, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.