EUVD-2026-93996
GHSA-7hfw-grcm-cqm6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable endpoint with low complexity, but needs an authenticated internal account (PR:L); only limited metadata confidentiality impact, with no integrity or availability effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment's permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified. This issue is fixed in version 4.1.0.
AnalysisAI
Incorrect authorization in the Backstage scaffolder backend (@backstage/plugin-scaffolder-backend) prior to 4.1.0 lets an authenticated user with a valid portal account list scaffolder task metadata that the deployment's permission policy intended to restrict, yielding low-impact information disclosure (CVSS 3.1 base 4.3, PR:L - authentication requirements confirmed by the vector, which contains PR:L). Exposure is confined to task metadata because stored task secrets are not part of the affected response, and deployments that do not enforce a restrictive task visibility policy have essentially nothing to leak. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated internal user with valid access to the Backstage portal and its scaffolder plugin (PR:L); anonymous or external attackers cannot exploit this. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-severity information-disclosure issue that should be treated as a routine, low-priority patch rather than an emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch by upgrading @backstage/plugin-scaffolder-backend to version 4.1.0 or later, which is the fix boundary given in advisory GHSA-7hfw-grcm-cqm6 and corresponds to the code change that throws NotAllowedError on a denied task-read decision; deployments tracking the main repository can also pick up the change from commit 0253c50673f2832b0b1e9f73348186434e7bd09e, included in release tag v1.54.6. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Backstage is an open platform for building developer portals. Rated critical severity (CVSS 9.9), this vulnerability is
Authenticated Backstage users can retrieve the internal execution data of other users' Scaffolder tasks - notably the Se
Authenticated users who can register or modify a TechDocs documentation source can achieve code execution inside the Bac
Arbitrary Python code execution in Backstage's @backstage/plugin-techdocs-node (versions < 1.13.11 and = 1.14.0) lets a
Authenticated remote code execution in the @backstage/plugin-techdocs-node package shipped with the Backstage developer
Improper task-state validation in the @backstage/plugin-scaffolder-backend plugin (Backstage versions prior to 3.3.1, 3.
Path traversal in the Backstage Scaffolder Bitbucket pull-request publish actions allows an authenticated user who can e
Improper input validation in the @backstage/plugin-scaffolder-backend-module-sentry scaffolder actions (Backstage 0.3.0
@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Rated high severity (C
Improper authentication in the Backstage @backstage/plugin-auth-backend-module-oidc-provider package prior to 0.4.20 let
Server-side request forgery in the Backstage @backstage/plugin-techdocs-node package (0.11.12 through 1.14.6, and 1.15.0
Improper URL validation in the @backstage/plugin-catalog-backend package of Backstage prior to 3.5.1, 3.6.2, 3.7.2, 3.8.
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today