Backstage is an open framework for building developer portals. Prior to v1.54.6, the scaffolder source‑control actions sometimes failed to enforce the intended credential boundaries. An authenticated user could trigger an action that falls back to broader integration credentials, allowing the user to perform operations with privileges beyond those originally intended. This results in an elevation of privilege scenario where attacker‑controlled code can access or modify repository or project data beyond authorized scopes.

Backstage, the open framework for building developer portals, and its scaffolder backend plugins for Azure, Bitbucket Cloud, Bitbucket Server, GitHub, and GitLab are affected. Versions earlier than 1.54.6 are vulnerable. The issue is mitigated in Backstage v1.54.6 only if the configuration setting scaffolder.requireScmUserCredentials is also enabled.

The CVSS score of 6.4 indicates moderate severity. The EPSS score is less than 1%, implying a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with scaffolder privileges and the presence of the fallback mechanism; the attacker can manipulate a scaffolder action to trigger the unintended credential usage.