CVE-2026-106503

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 3.3.1 Backstage versions prior to 3.4.1 Backstage versions prior to 4.0.3 Backstage versions prior to 4.1.0

Description The @backstage/plugin-scaffolder-backend package contains an authorization bypass regarding scaffolder action inputs. An authenticated user with access to affected Scaffolder templates can bypass configured action restrictions, potentially granting unauthorized access to repositories and related source-control resources depending on the integration credentials used.

Recommendations Update to version 3.3.1 Update to version 3.4.1 Update to version 4.0.3 Update to version 4.1.0