Plugin Scaffolder Backend Module Azure
Monthly
An authenticated Backstage user who can run scaffolder templates can invoke built-in source-control actions (GitHub, GitLab, Azure DevOps, Bitbucket Cloud, Bitbucket Server) without supplying a personal SCM token, causing those actions to fall back to shared integration credentials and perform repository operations with broader privileges than the invoking user holds. The flaw affects deployments on Backstage versions prior to 1.54.6 that have SCM integration credentials configured; custom actions and SCM readers that do not accept a user-token input are unaffected. Exploitation requires the PR:L (authenticated) precondition and offers limited confidentiality and integrity impact with scope change, and no public exploit code has been identified at time of analysis.
An authenticated Backstage user who can run scaffolder templates can invoke built-in source-control actions (GitHub, GitLab, Azure DevOps, Bitbucket Cloud, Bitbucket Server) without supplying a personal SCM token, causing those actions to fall back to shared integration credentials and perform repository operations with broader privileges than the invoking user holds. The flaw affects deployments on Backstage versions prior to 1.54.6 that have SCM integration credentials configured; custom actions and SCM readers that do not accept a user-token input are unaffected. Exploitation requires the PR:L (authenticated) precondition and offers limited confidentiality and integrity impact with scope change, and no public exploit code has been identified at time of analysis.