Backstage Scaffolder EUVD-2026-94068

Exploitation requires an authenticated Backstage user who already has access to the affected Scaffolder templates AND an administrator-configured Scaffolder permission policy that restricts actions by input value using rules such as HAS_STRING_PROPERTY/HAS_ACTION_ID (e.g., 'custom:gitlab:group:access', 'github:group:access', 'bitbucketCloud:group:access', or 'publish:github:pull-request'). The bypass works by supplying the restricted input value with different letter casing or as a different JSON type (string vs number). Limiting factors: the attacker must be authenticated and authorized to reach the templates; the impact is bounded by the privileges of the backend integration credentials attached to the scaffolder actions; and deployments that do not use input-value-based permission restrictions have no restriction to bypass. Running an affected version prior to 3.3.1 / 3.4.1 / 4.0.3 / 4.1.0 is required.

This is a credible, moderately high-priority issue for organizations running Backstage with Scaffolder permission policies, but it is not a mass-exploitation threat. The CVSS 8.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates a network-reachable, low-complexity flaw requiring low privileges - consistent with the description, which states an *authenticated* user who already has access to affected Scaffolder templates can bypass configured action restrictions. The PR:L in the vector aligns with the 'authenticated user' language, so this is an authorization bypass, not an unauthenticated takeover. The root cause is confirmed by the source code evidence as a CWE-178 case-sensitivity / type-coercion matching flaw: the HAS_STRING_PROPERTY permission rule matched 'example/team' but not 'ExAmPlE/TeAm' or numeric equivalents, letting a user evade input-value restrictions by altering case or type. No EPSS score, KEV listing, or public POC was provided in the input; exploitation requires insider-level access to templates and depends on how impactful the integration credentials (e.g., GitHub/GitLab/Bitbucket tokens) wired into the actions are, so real-world risk is organization-specific and tilts toward privilege escalation by trusted-but-restricted internal users rather than widespread external attack. A:N correctly reflects no availability impact; the danger is unauthorized read/write to source-control resources.

An authenticated Backstage user who is restricted by a Scaffolder permission policy (e.g., allowed to run a group-access or publish action only against 'example/team') crafts a template execution that supplies the restricted value with altered casing ('ExAmPlE/TeAm') or as a different type (numeric 42 vs string '42'), causing the permission rule to fail to match and allowing the otherwise-denied action to run. Because the action executes with the backend's configured integration credentials, this can grant unauthorized access to repositories and source-control resources the user should not reach. No public exploit code was identified in the provided data, though the fix commit and its tests publicly demonstrate the exact bypass patterns.