CVE-2026-106506
5.3
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 1.6 / Impact: 3.6
Source: security-advisories@github.com (Secondary)
Description
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user with permission to create and read relevant scaffolder tasks may be able to infer confidential task data under specific conditions. Successful exploitation requires retained task secrets, visibility of a target task, knowledge of the secret structure, and repeated requests. This issue is fixed in version 4.1.0.
Affected (2)
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| version < 4.1.0 |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| version < 1.54.6 |
Related CWEs
CWE-202
Exposure of Sensitive Information Through Data Queries
When trying to keep information confidential, an attacker can often infer some of the information by using statistics.
CWE-203
Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
References (3)
Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
PatchRelease Notes
Source: security-advisories@github.com
MitigationVendor Advisory
Timeline
No history available yet.