| Package | Affected versions | Patched versions |
|---|---|---|
| backstage | ≥ 1.50.0, < 1.50.5≥ 1.51.0, < 1.54.6< 1.49.6 | 1.50.51.54.61.49.6 |
| backstage/plugin-scaffolder-backend | ≥ 3.4.0, < 3.4.1≥ 4.0.0, < 4.0.3≥ 4.0.4, < 4.1.0< 3.3.1 | 3.4.14.0.34.1.03.3.1 |
| @backstage/plugin-scaffolder-backend | ≥ 3.4.0, < 3.4.1≥ 4.0.0, < 4.0.3≥ 4.0.4, < 4.1.0< 3.3.1 | 3.4.14.0.34.1.03.3.1 |
An authenticated user with access to affected Scaffolder templates could bypass configured action restrictions. Depending on integration credentials, this could grant unauthorized access to repositories and related source-control resources.
Patched in @backstage/plugin-scaffolder-backend version 4.1.0
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free