CVE-2026-106503: backstage Improper Handling of Case Sensitivity
Vulnerability summary
CVE-2026-106503 is a high (CVSS 8.1) Improper Handling of Case Sensitivity vulnerability in backstage. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.7% of scored vulnerabilities.
Timeline
- 06-10-2026PublishedVulnerability first disclosed.
- 09-10-2026Last modifiedVulnerability information updated.
Description
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by scaffolder action input authorization bypass. An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · NpmEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.38%
Chance of exploitation in the next 30 days
Percentile
31%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-178Improper Handling of Case SensitivityThe product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Affected systems
@backstage2 products
- plugin-scaffolder-backend< 3.3.1 | ≥ 3.4.0, < 3.4.1 | ≥ 4.0.0, < 4.0.3 | ≥ 4.0.4, < 4.1.0
- plugin-scaffolder-backend< 3.3.1 | ≥ 3.4.0, < 3.4.1 | ≥ 4.0.0, < 4.0.3 | ≥ 4.0.4, < 4.1.0
Linuxfoundation2 products
- backstage< 1.49.6 | ≥ 1.50.0, < 1.50.5 | ≥ 1.51.0, < 1.54.6
- backstage\/plugin-scaffolder-backend< 3.3.1 | ≥ 3.4.0, < 3.4.1 | ≥ 4.0.0, < 4.0.3 | ≥ 4.0.4, < 4.1.0
Backstage1 product
- backstage< 1.49.6 | ≥ 1.50.0-next.0, < 1.50.5 | ≥ 1.51.0-next.0, < 1.54.6
3 vendors · 5 products
References
9 links- github.com/backstage/backstage/security/advisories/GHSA-hmp2-4m7g-22cvX Refsource CONFIRMWEBMitigationVendor Advisory
- github.com/backstage/backstage/commit/11c1384c0649b8ab26391c6a4e4f34b80ab0d188X Refsource MISCWEBPatch
- github.com/backstage/backstage/commit/a91ed72d540e80b62a73b39bb1563ff5018d52d1X Refsource MISCWEBPatch
- github.com/backstage/backstage/commit/e307e4f487103d815e484291b3fda778ab9983bfX Refsource MISCWEBPatch
