{"action":"Upgrade @backstage/plugin-scaffolder-backend to 3.3.1 or later.","affected":[{"fixed":"3.3.1","introduced":"0"},{"fixed":"3.4.1","introduced":"3.4.0"},{"fixed":"4.0.3","introduced":"4.0.0"},{"fixed":"4.1.0","introduced":"4.0.4"}],"component":"@backstage/plugin-scaffolder-backend","cve_ids":["CVE-2026-106503"],"ecosystem":"npm","epss":0.00382,"exploited":false,"fixed_versions":["3.3.1","3.4.1","4.0.3","4.1.0"],"ghsa_id":"GHSA-hmp2-4m7g-22cv","id":"tcs_01M5KFVJK095EJC2AXYMMHM5DD","modified_at":"2026-10-07T18:15:12.169871159Z","published_at":"2026-10-07T17:59:08Z","references":["https://osv.dev/vulnerability/GHSA-hmp2-4m7g-22cv","https://github.com/backstage/backstage/security/advisories/GHSA-hmp2-4m7g-22cv","https://nvd.nist.gov/vuln/detail/CVE-2026-106503","https://github.com/backstage/backstage/commit/11c1384c0649b8ab26391c6a4e4f34b80ab0d188","https://github.com/backstage/backstage/commit/a91ed72d540e80b62a73b39bb1563ff5018d52d1","https://github.com/backstage/backstage/commit/e307e4f487103d815e484291b3fda778ab9983bf","https://github.com/backstage/backstage","https://github.com/backstage/backstage/releases/tag/v1.49.6","https://github.com/backstage/backstage/releases/tag/v1.50.5","https://github.com/backstage/backstage/releases/tag/v1.54.6"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-hmp2-4m7g-22cv","url":"https://osv.dev/vulnerability/GHSA-hmp2-4m7g-22cv"}],"summary":"Backstage: Scaffolder action input authorization bypass"}