EUVD-2026-93999
GHSA-29gx-h2m3-xw44
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Authenticated template-runner (PR:L) triggers a network action with low complexity; scope changes as impact crosses into the SCM system, yielding limited confidentiality/integrity over-reach and no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2Blast Radius
ecosystem impact- 5 npm packages depend on @backstage/plugin-scaffolder-backend-module-github (2 direct, 3 indirect)
- 1 npm packages depend on @backstage/plugin-scaffolder-backend-module-gitlab (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.9.13 and other introduced versions.
DescriptionCVE.org
Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.
AnalysisAI
An authenticated Backstage user who can run scaffolder templates can invoke built-in source-control actions (GitHub, GitLab, Azure DevOps, Bitbucket Cloud, Bitbucket Server) without supplying a personal SCM token, causing those actions to fall back to shared integration credentials and perform repository operations with broader privileges than the invoking user holds. The flaw affects deployments on Backstage versions prior to 1.54.6 that have SCM integration credentials configured; custom actions and SCM readers that do not accept a user-token input are unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Backstage user with permission to execute scaffolder software templates that use built-in source-control mutation or fetch actions for GitHub, GitLab, Azure DevOps, Bitbucket Cloud, or Bitbucket Server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-severity confused-deputy flaw (CWE-441) that warrants routine patch prioritization rather than emergency response. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Backstage to 1.54.6 (the release that contains the fix) and, critically, also set scaffolder.requireScmUserCredentials: true in the scaffolder configuration - upgrading alone does not remediate because enforcement of the user-credential requirement is gated behind this option. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Backstage is an open platform for building developer portals. Rated critical severity (CVSS 9.9), this vulnerability is
Authenticated Backstage users can retrieve the internal execution data of other users' Scaffolder tasks - notably the Se
Authenticated users who can register or modify a TechDocs documentation source can achieve code execution inside the Bac
Arbitrary Python code execution in Backstage's @backstage/plugin-techdocs-node (versions < 1.13.11 and = 1.14.0) lets a
Authenticated remote code execution in the @backstage/plugin-techdocs-node package shipped with the Backstage developer
Improper task-state validation in the @backstage/plugin-scaffolder-backend plugin (Backstage versions prior to 3.3.1, 3.
Path traversal in the Backstage Scaffolder Bitbucket pull-request publish actions allows an authenticated user who can e
Improper input validation in the @backstage/plugin-scaffolder-backend-module-sentry scaffolder actions (Backstage 0.3.0
@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Rated high severity (C
Improper authentication in the Backstage @backstage/plugin-auth-backend-module-oidc-provider package prior to 0.4.20 let
Server-side request forgery in the Backstage @backstage/plugin-techdocs-node package (0.11.12 through 1.14.6, and 1.15.0
Improper URL validation in the @backstage/plugin-catalog-backend package of Backstage prior to 3.5.1, 3.6.2, 3.7.2, 3.8.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today