The vulnerability is a mis‑authorization flaw in the @backstage/plugin‑scaffolder‑backend component, allowing an authenticated internal user to list scaffolder tasks that are outside the visibility scope defined by the deployment’s permission policy. The weakness is identified as CWE‑201 and CWE‑863, which describe improper authorization and data exposure. The flaw does not expose stored task secrets, and no integrity or availability effects were reported. The impact is primarily the disclosure of task metadata, potentially revealing project structure, configuration, or planning details that could aid an attacker or lead to internal data leakage.

Affected components include the Backstage framework and its plugin‑scaffolder‑backend module. Versions prior to 4.1.0 of @backstage/plugin‑scaffolder‑backend are vulnerable; the Backstage framework itself must be running a compatible version of the plugin to be impacted. The problem has been fixed in plugin version 4.1.0, and patching to that release removes the flaw.

The CVSS score of 4.3 indicates a moderate risk level. The EPSS score is < 1%, and the flaw is not listed in CISA’s KEV catalog, implying no known exploited instances yet. The likely attack vector involves an authenticated internal user under a deployment’s permission policy; no external or unauthenticated access is required. Because the flaw only grants additional visibility and does not affect secrets or system stability, the overall threat remains primarily informational. Nonetheless, organizations with stringent data privacy requirements should treat this as a risk that warrants timely remediation.