GHSA-hmp2-4m7g-22cv CVE-2026-106503

Backstage: Scaffolder action input authorization bypass

High npm

Severity: 8.1 / 10; High · CVSS 3.1
Exploit chance (EPSS): 0.49%; Chance of exploitation in the next 30 days. Higher than 42.30% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-178 Improper Handling of Case Sensitivity; CWE-284 Improper Access Control
Fix: 3.3.1; Upgrade @backstage/plugin-scaffolder-backend to this version or later

Description

Impact

An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources.

Patches

Patched in @backstage/plugin-scaffolder-backend version 4.1.0

Workarounds

Restrict affected Scaffolder actions to trusted users and configure source-control integrations with least-privilege credentials.

Affected versions

npm

Package	Vulnerable	Fixed in
@backstage/plugin-scaffolder-backend	`< 3.3.1`	`3.3.1`
@backstage/plugin-scaffolder-backend	`>= 3.4.0, < 3.4.1`	`3.4.1`
@backstage/plugin-scaffolder-backend	`>= 4.0.0, < 4.0.3`	`4.0.3`
@backstage/plugin-scaffolder-backend	`>= 4.0.4, < 4.1.0`	`4.1.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

@backstage/plugin-scaffolder-backend npm → `3.3.1`

npm

npm install @backstage/plugin-scaffolder-backend@3.3.1

yarn

yarn add @backstage/plugin-scaffolder-backend@3.3.1

pnpm

pnpm add @backstage/plugin-scaffolder-backend@3.3.1

Severity breakdown

CVSS 3.1 8.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

Weakness

CWE-178: Improper Handling of Case Sensitivity

The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

How to prevent it

Architecture and Design: Avoid making decisions based on names of resources (e.g. files) if those resources can have alternate names.
Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Implementation: Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.

CWE-284: Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

How to prevent it

Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2026-106503

Packages

github.com/backstage/backstage

Timeline

Oct 6, 2026 Published
Oct 13, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-vwp5-f99x-x3rq Backstage has improper input validation in scaffolder task list ordering	Medium	Also affects @backstage/plugin-scaffolder-backend
GHSA-4xvq-3m68-h444 Backstage has sensitive information exposure in scaffolder task logs	Medium	Also affects @backstage/plugin-scaffolder-backend
GHSA-95p4-vv4g-jxxm Backstage may expose sensitive information in Scaffolder task failure events	Medium	Also affects @backstage/plugin-scaffolder-backend
GHSA-g2v8-7jhw-pp8p Backstage: Sensitive information exposure in Scaffolder	Critical	Also affects @backstage/plugin-scaffolder-backend
GHSA-xvgh-hmx8-9xxf Backstage: Improper task state validation in Scaffolder backend	High	Also affects @backstage/plugin-scaffolder-backend
GHSA-mfvq-x7vr-rgqg Backstage: Secret-derived values may be exposed in scaffolder task logs	Medium	Also affects @backstage/plugin-scaffolder-backend
GHSA-29gx-h2m3-xw44 Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback	Medium	Also affects @backstage/plugin-scaffolder-backend
GHSA-7hfw-grcm-cqm6 Backstage: Incorrect authorization in scaffolder task listing	Medium	Also affects @backstage/plugin-scaffolder-backend

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor