GHSA-7hfw-grcm-cqm6 Backstage: Incorrect authorization in scaffolder task listing

• npm @backstage/plugin-scaffolder-backend: < 4.1.0 → fixed in 4.1.0

Impact An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment's permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified. Patches Patched in `@backstage/plugin-scaffolder-backend` version `4.1.0` Workarounds • Restrict the scaffolder task-list endpoint at the ingress or authenticating proxy to users who are permitted to view all tasks. • Avoid placing sensitive values in template input parameters until the patched package is deployed.