Improper input validation in the @backstage/plugin-scaffolder-backend-module-sentry module allows an authenticated internal user to cause the backend to contact unintended destinations, exposing Sentry integration credentials. The primary impact is a confidentiality breach of Sentry credentials and potential unauthorized network activity depending on token reachability and privileges.

Deployments of Backstage that include @backstage/plugin-scaffolder-backend-module-sentry versions 0.3.0 through 0.3.8 are affected. Any Backstage instance that permits internal authenticated users to execute scaffolder actions and uses these module versions is potentially vulnerable until the module is updated to the patched 0.3.8 release or later.

The CVSS score of 8.5 classifies this vulnerability as high severity, but the EPSS score is not available, suggesting no public exploitation yet. It is not listed in the CISA KEV catalog. Exploitation requires an internal user with permission to run the affected scaffolder actions, limiting the attack surface to organizations that grant such privileges. If the Sentry token has broad privileges, the credential disclosure could enable further attacks, but impact depends on network reachability and token scope.