{"vulnerability": "cve-2026-106501", "sightings": [{"uuid": "5625354c-3033-418c-a6ae-5e3fe7545ede", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-106501", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxansj2ivj2o", "content": "\ud83d\udea8 CVE-2026-106501 \u2014 CVSS 9.6 CRITICAL\n\nBackstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-106501\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-07T00:10:23.035964Z"}, {"uuid": "c6bce378-4ff0-494a-94c6-d548fbd74a97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-106501", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxc7jfpqnm2w", "content": "CVE-2026-106501 - backstage\nThe Backstage developer portal's scaffolder component can let an authenticated user see another user's task details, including any internal data such as service credentials. If those\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#backstage #CVE #infosec", "creation_timestamp": "2026-10-07T15:00:04.487607Z"}, {"uuid": "e4fc98c9-1f32-4d06-bb73-8f53d790cf47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-106501", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117403407182699657", "content": "CVE-2026-106501: @backstage/plugin-scaffolder-backend CRITICAL vuln (CVSS 9.6) allows authenticated users to access other users\u2019 task data, incl. credentials. Patch to 4.1.0 now. Restrict task read perms as interim measure. https://radar.offseq.com/threat/plugin-scaffolder-backend-backstage-sensitive-information-exposure-in-scaffolder-cve-2026-106501-af878d1e8ab7288a #OffSeq #Backstage #Vuln", "creation_timestamp": "2026-10-08T04:30:26.115427Z"}]}