An authenticated Backstage user with permission to create and read scaffolder tasks may be able to infer confidential task data by exploiting improper input validation in the order of scaffolder tasks. The flaw requires that task secrets remain retained, the target task be visible, knowledge of the secret structure, and repeated requests, thereby allowing the attacker to glean sensitive information from the task metadata.

Backstage environments that use @backstage/plugin-scaffolder-backend before version 4.1.0, including any deployments of backstage:backstage hosted by the community or custom integrations. The vulnerability affects all installations that deploy the plugin without the update to 4.1.0 or later.

The CVSS score of 5.3 indicates moderate severity and the exploitation requires an authenticated user who has the appropriate scoper privileges. Because the threat is restricted to users who can create and read tasks and requires repeated requests, the likelihood is moderate but limited primarily to trusted internal users. There is no known public exploit, the EPSS score is 0.00217, and it is not listed in the CISA KEV catalog.