Backstage’s @backstage/backend-defaults package improperly preserves access restrictions when delegating service credentials, allowing an external service credential that has been configured with limited access (for example, read‑only) to bypass those restrictions by routing requests through plugin delegation paths. This vulnerability, which aligns with the authorization bypass weaknesses in CWE‑269, privilege escalation in CWE‑863, and improper access control in CWE‑281, can enable a restricted service to perform higher‑level operations such as write actions on plugins it was intended to be allowed only read access to.

The issue affects the @backstage/backend-defaults and backstage:backstage products from the project’s open framework, for all releases prior to 0.16.1 and 0.17.8. Users employing older versions should verify their installed package versions to confirm exposure.

The CVSS score of 7.6 reflects a high potential for exploitation, though no EPSS score is presently available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector likely involves an attacker who has control over an external service credential; by configuring this credential with limited permissions and then directing its traffic through delegations, the attacker could elevate its effective privileges within the Backstage portal. No additional prerequisites beyond the presence of a delegatable service credential are stated, so the exploit appears straightforward for a knowledgeable adversary.