CVE-2026-106503

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106503

EUVD

EUVD-2026-94068

Affected Vendors & Products

Vendor	Product	Version / Range
linuxfoundation	backstage/plugin-scaffolder-backend	to 3.3.1 (exc)
linuxfoundation	backstage/plugin-scaffolder-backend	From 3.4.0 (inc) to 3.4.1 (exc)
linuxfoundation	backstage/plugin-scaffolder-backend	From 4.0.0 (inc) to 4.0.3 (exc)
linuxfoundation	backstage/plugin-scaffolder-backend	From 4.0.4 (inc) to 4.1.0 (exc)
linuxfoundation	backstage	to 1.49.6 (exc)
linuxfoundation	backstage	From 1.50.0 (inc) to 1.50.5 (exc)
linuxfoundation	backstage	From 1.51.0 (inc) to 1.54.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-178	The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Attack-Flow Graph

Executive Summary

This vulnerability affects the @backstage/plugin-scaffolder-backend package in Backstage versions before 3.3.1, 3.4.1, 4.0.3, and 4.1.0. It allows an authenticated user with access to Scaffolder templates to bypass configured action restrictions, potentially granting unauthorized access to repositories and source-control resources.

Detection Guidance

To detect this vulnerability, check the installed version of @backstage/plugin-scaffolder-backend. If your version is below 3.3.1, 3.4.1, 4.0.3, or 4.1.0, the system is vulnerable. Review Scaffolder template configurations for unauthorized access patterns or unexpected action executions.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to repositories and related resources, depending on the integration credentials available. This may lead to data breaches, unauthorized code changes, or exposure of sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade @backstage/plugin-scaffolder-backend to version 3.3.1, 3.4.1, 4.0.3, or 4.1.0 immediately. Review and restrict Scaffolder template permissions to prevent unauthorized actions. Audit recent template executions for suspicious activity.

Hi! I’m here to help you understand CVE-2026-106503. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70