CVE-2026-106506

A flaw was found in plugin-scaffolder-backend. This vulnerability allows an authenticated user with permission to create and view tasks to access confidential task secrets, resulting in information disclosure. Due to improper input validation in task list ordering, an attacker can submit repeated...

Backstage has improper input validation in scaffolder task list ordering

Impact An authenticated Backstage user with permission to create and read relevant scaffolder tasks may be able to infer confidential task data under specific conditions. Successful exploitation requires retained task secrets, visibility of a target task, knowledge of the secret structure, and...

GHSA-VWP5-F99X-X3RQ Backstage has improper input validation in scaffolder task list ordering

Impact An authenticated Backstage user with permission to create and read relevant scaffolder tasks may be able to infer confidential task data under specific conditions. Successful exploitation requires retained task secrets, visibility of a target task, knowledge of the secret structure, and...

CVE-2026-106506

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user with permission to create and read relevant scaffolder tasks m...

CVE-2026-106506 Backstage: Improper input validation in scaffolder task list ordering

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user with permission to create and read relevant scaffolder tasks m...

CVE-2026-106506

The Backstage framework is vulnerable to improper input validation within the @backstage/plugin-scaffolder-backend package in versions prior to 4.1.0 . This flaw exists in the scaffolder task list ordering functionality, potentially allowing an authenticated user with permissions to create and re...

CVE-2026-106506

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user with permission to create and read relevant scaffolder tasks m...

CVE-2026-106506 Backstage: Improper input validation in scaffolder task list ordering

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user with permission to create and read relevant scaffolder tasks m...

CVE-2026-106506: Exposure of Sensitive Information Through Data Queries

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user with permission to create and read relevant scaffolder tasks m...