Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment's permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified. This issue is fixed in version 4.1.0.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/backstage/backstage/commit/0253c50673f2832b0b1e9f73348186434e7bd09e Patch
- https://github.com/backstage/backstage/releases/tag/v1.54.6 Patch, Release Notes
- https://github.com/backstage/backstage/security/advisories/GHSA-7hfw-grcm-cqm6 Mitigation, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 4.3 · linuxfoundationNVD modified 2026-10-23 15:01
Affected (CPE criteria) 2
cpe:2.3:a:linuxfoundation:backstage\/plugin-scaffolder-backend:*:*:*:*:*:node.js:*:*cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*