CVE-2026-106461

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment's permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified. This issue is fixed in version 4.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106461

EUVD

EUVD-2026-93996

Affected Vendors & Products

Vendor	Product	Version / Range
backstage	backstage	< 1.54.6
@backstage	plugin-scaffolder-backend	< 4.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Backstage is an open framework for building developer portals. The vulnerability in the @backstage/plugin-scaffolder-backend package before version 4.1.0 allows incorrect authorization in scaffolder task listing. An authenticated internal user can view metadata for tasks they should not have access to based on the deployment's permission policy. Stored task secrets are not exposed, and there is no impact on data integrity or availability.

Detection Guidance

Check the version of @backstage/plugin-scaffolder-backend. If it is below 4.1.0, the system is vulnerable. Use commands like npm list @backstage/plugin-scaffolder-backend or yarn list @backstage/plugin-scaffolder-backend to verify the installed version.

Impact Analysis

An authenticated internal user may gain unauthorized access to task metadata they are not permitted to see. This could lead to information leakage about internal processes or sensitive operations, though actual secrets are not exposed. The impact is limited to confidentiality of task metadata.

Compliance Impact

The vulnerability allows unauthorized access to metadata for scaffolder tasks, which could potentially expose sensitive information. This may impact compliance with GDPR if personal data is involved, as unauthorized access could violate data protection principles. For HIPAA, if task metadata includes protected health information, the exposure could breach confidentiality requirements.

Mitigation Strategies

Upgrade @backstage/plugin-scaffolder-backend to version 4.1.0 or later. Review and adjust permission policies to ensure proper access controls for scaffolder tasks.

Hi! I’m here to help you understand CVE-2026-106461. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70