Backstage Scaffolder Backend: Authorization bypass in scaffolder action input
Summary
The Scaffolder backend plugin of Backstage, a developer portal framework, contains an authorization bypass in how action input values are checked against permission policies. An authenticated user with access to affected Scaffolder templates can bypass configured action restrictions. Depending on the credentials used for source-control integrations, this can grant unauthorized access to repositories and related source-control resources. The NVD/CVE record gives a CVSS 3.1 base score of 8.1 (High).
Affected
- @backstage/plugin-scaffolder-backend before 3.3.1
- @backstage/plugin-scaffolder-backend 3.4.0 before 3.4.1
- @backstage/plugin-scaffolder-backend 4.0.0 before 4.1.0 (per the CVE record, including 4.0.4 to 4.1.0)
- Backstage core releases before 1.49.6, 1.50.0-next.0 to 1.50.5, and 1.51.0-next.0 to 1.54.6
Fixed in
- @backstage/plugin-scaffolder-backend 3.3.1 and 3.4.1 (3.x line)
- @backstage/plugin-scaffolder-backend 4.1.0 (4.x line; the vendor advisory lists 4.1.0 as the patched version)
- Backstage core 1.49.6, 1.50.5 and 1.54.6
Workaround
- Restrict affected Scaffolder actions to trusted users (vendor advisory).
- Configure source-control integrations with least-privilege credentials (vendor advisory).
Exploitation
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
- Not marked as known exploited in the sources checked; the CISA KEV catalogue was not checked directly.
- No public proof of concept found in the research. This does not prove none exists.
Our recommendation
- Update @backstage/plugin-scaffolder-backend to 3.3.1 or 3.4.1 (3.x) or to 4.1.0 (4.x); for 4.x, do not stop at 4.0.3.
- Until the update is applied, limit who can run affected Scaffolder templates.
- Review the tokens used by the Scaffolder backend for GitHub, GitLab or other SCM integrations and reduce them to least privilege.
- Check audit logs and template run history for unexpected actions on repositories.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GHSA-hmp2-4m7g-22cv (GitHub Security Advisory) github.com
- OSV record GHSA-hmp2-4m7g-22cv osv.dev
- Fix commit 11c1384 (input handling) github.com
- Fix commit a91ed72 github.com
- Fix commit e307e4f github.com
- Backstage release v1.49.6 github.com
- Backstage release v1.50.5 github.com
- Backstage release v1.54.6 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:38.
Original description (NVD)
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.
NVD references (7)
- https://github.com/backstage/backstage/commit/11c1384c0649b8ab26391c6a4e4f34b80ab0d188
- https://github.com/backstage/backstage/commit/a91ed72d540e80b62a73b39bb1563ff5018d52d1
- https://github.com/backstage/backstage/commit/e307e4f487103d815e484291b3fda778ab9983bf
- https://github.com/backstage/backstage/releases/tag/v1.49.6
- https://github.com/backstage/backstage/releases/tag/v1.50.5
- https://github.com/backstage/backstage/releases/tag/v1.54.6
- https://github.com/backstage/backstage/security/advisories/GHSA-hmp2-4m7g-22cv
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.