Authorization Bypass in Backstage Plugin by Backstage
CVE-2026-106503
8.1HIGH
What is CVE-2026-106503?
The plugin-scaffolder-backend package in Backstage, prior to updates in versions 3.3.1, 3.4.1, 4.0.3, and 4.1.0, is susceptible to an authorization bypass. An authenticated user who has access to certain Scaffolder templates may exploit this vulnerability to bypass established action restrictions. This could potentially lead to unauthorized access to sensitive repositories and associated source-control resources, posing a significant security risk.
Affected Version(s)
backstage < 1.49.6 < 1.49.6
backstage >= 1.50.0-next.0, < 1.50.5 < 1.50.0-next.0, 1.50.5
backstage >= 1.51.0-next.0, < 1.54.6 < 1.51.0-next.0, 1.54.6