Backstage's @backstage/plugin-scaffolder-backend stored internal execution data in a way that, if a logged‑in user could read another user's scaffolder tasks, that data could be disclosed. The exposed data may include credentials for external services, giving an attacker the ability to read sensitive information and potentially make unauthorized changes to those services. The flaw arises from improper access controls over task data, exposing both general data and specific credentials. The vulnerability is classified under CWE-200 and CWE-201.

The vulnerability affects the @backstage/plugin-scaffolder-backend package and the Backstage framework prior to versions 3.3.1, 3.4.1, 4.0.3, and 4.1.0. All deployments using these versions are susceptible until they are upgraded to the patched releases detailed in the official changelogs.

The CVSS score of 9.6 places this flaw in the critical category. Although an EPSS score is not available, the lack of listings in CISA's KEV catalog does not diminish the inherent risk. The attack vector requires an authenticated user with the privilege to view other users’ scaffolder tasks; once the data is accessed, exposed credentials can be used to compromise external services. Given the high severity score and the potential impact on both internal data integrity and external service security, the risk remains significant until mitigation actions are applied.