CVE-2026-106461

A flaw was found in plugin-scaffolder-backend. An improper authorization flaw allows an authenticated user to view task metadata outside their intended permissions, resulting in unauthorized information disclosure. This vulnerability occurs during scaffolder task listing when deployment permissio...

CVE-2026-106461 Backstage: Incorrect authorization in scaffolder task listing

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibilit...

CVE-2026-106461 Backstage: Incorrect authorization in scaffolder task listing

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibilit...

CVE-2026-106461: Incorrect Authorization

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibilit...