The vulnerability is a scaffolder action input authorization bypass that allows an authenticated user with access to affected Scaffolder templates to override configured action restrictions. As a result, the attacker could access repositories and source‑control resources that they normally would not be authorized to reach, depending on the credentials integrated with the scaffolder action. This flaw is categorized as a combination of improper input validation (CWE‑178), insufficient authorization controls (CWE‑284), and improper error handling (CWE‑807).

The affected components are the @backstage/plugin-scaffolder-backend package and the core backstage application, with vulnerable versions prior to 3.3.1, 3.4.1, 4.0.3, and 4.1.0.

The flaw carries a CVSS score of 8.1, indicating high severity. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated user exploiting template privileges, which is inferred from the description; a malicious user with template access can bypass restrictions. Given the lack of public exploit evidence and the need for legitimate credentials, the threat is significant for organizations that expose scaffolder templates to privileged users or allow extensive repository access via the plugin.