Plugin Scaffolder Backend
Monthly
An authenticated Backstage user who can run scaffolder templates can invoke built-in source-control actions (GitHub, GitLab, Azure DevOps, Bitbucket Cloud, Bitbucket Server) without supplying a personal SCM token, causing those actions to fall back to shared integration credentials and perform repository operations with broader privileges than the invoking user holds. The flaw affects deployments on Backstage versions prior to 1.54.6 that have SCM integration credentials configured; custom actions and SCM readers that do not accept a user-token input are unaffected. Exploitation requires the PR:L (authenticated) precondition and offers limited confidentiality and integrity impact with scope change, and no public exploit code has been identified at time of analysis.
Incorrect authorization in the Backstage scaffolder backend (@backstage/plugin-scaffolder-backend) prior to 4.1.0 lets an authenticated user with a valid portal account list scaffolder task metadata that the deployment's permission policy intended to restrict, yielding low-impact information disclosure (CVSS 3.1 base 4.3, PR:L - authentication requirements confirmed by the vector, which contains PR:L). Exposure is confined to task metadata because stored task secrets are not part of the affected response, and deployments that do not enforce a restrictive task visibility policy have essentially nothing to leak. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; a vendor-released patch is available in version 4.1.0.
An authenticated Backstage user who can run scaffolder templates can invoke built-in source-control actions (GitHub, GitLab, Azure DevOps, Bitbucket Cloud, Bitbucket Server) without supplying a personal SCM token, causing those actions to fall back to shared integration credentials and perform repository operations with broader privileges than the invoking user holds. The flaw affects deployments on Backstage versions prior to 1.54.6 that have SCM integration credentials configured; custom actions and SCM readers that do not accept a user-token input are unaffected. Exploitation requires the PR:L (authenticated) precondition and offers limited confidentiality and integrity impact with scope change, and no public exploit code has been identified at time of analysis.
Incorrect authorization in the Backstage scaffolder backend (@backstage/plugin-scaffolder-backend) prior to 4.1.0 lets an authenticated user with a valid portal account list scaffolder task metadata that the deployment's permission policy intended to restrict, yielding low-impact information disclosure (CVSS 3.1 base 4.3, PR:L - authentication requirements confirmed by the vector, which contains PR:L). Exposure is confined to task metadata because stored task secrets are not part of the affected response, and deployments that do not enforce a restrictive task visibility policy have essentially nothing to leak. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; a vendor-released patch is available in version 4.1.0.