plugin-scaffolder-backend vulnerabilities
CVEs whose affected-version data names the plugin-scaffolder-backend package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-106462Medium· 6.4Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall b…
▾ Sunlitbackstage · backstageEPSS 0.17%via NVD
CVE-2026-106461Medium· 4.3Backstage is an open framework for building developer portals
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by incorrect authorization in scaffolder task listing. An authenticated internal user may be able…
▾ Sunlitbackstage · backstageEPSS 0.19%via NVD