An authenticated user with permission to create and access Scaffolder tasks can, under specific timing and deployment conditions, bypass task state validation to write or delete files that the Backstage backend can access. The flaw permits modification of backend application files, which can lead to unauthorized disclosure, code execution, or availability loss. It represents a race condition (CWE‑362) combined with improper access control (CWE‑59) and path traversal (CWE‑367); the timing requirement implies a race condition, but this inference is not explicitly stated in the advisory.

The Backstage open‑source framework is affected, specifically the @backstage/plugin-scaffolder-backend package in Backstage versions prior to 3.3.1, 3.4.1, 4.0.3, and 4.1.0. Deployments of any of these older releases that use files writable by the Backstage backend are impacted.

With a CVSS score of 8.5 the vulnerability is considered high severity. EPSS data is not available, and it is not listed in CISA's KEV catalog, indicating no widespread exploitation is known. Exploitation would require an authenticated user with task‑creation rights and certain concurrent operations, making the attack complex but feasible for an insider or compromised user. Organizations using vulnerable Backstage versions should prioritize patching and enforce least‑privilege access.