CVE-2026-106461
CVE-2026-106461 · Backstage: Incorrect authorization in scaffolder task listing
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment's permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified. This issue is fixed in version 4.1.0.
CVSS 4.3 · Media · EPSS 0,2% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
backstage
- Versiones
- < 1.54.6: Afectada
Sin corrección publicada
plugin-scaffolder-backend
- Versiones
- < 4.1.0: Afectada
Sin corrección publicada
@backstage/plugin-scaffolder-backend npm
- Intervalos de versiones afectados
- SEMVER: < 4.1.0
Actualiza a 4.1.0