CVE-2025-32791

Permission policy information leakage in Backstage permission system

State: Published
Severity: 4.3 Medium
Published: Apr 16, 2025
Updated: Apr 17, 2025
Reserved: Apr 10, 2025

Description

The Backstage Scaffolder plugin houses types and utilities for building scaffolder-related modules. A vulnerability in the Backstage permission plugin backend allows callers to extract some information about the conditional decisions returned by the permission policy installed in the permission backend. If the permission system is not in use or if the installed permission policy does not use conditional decisions, there is no impact. This issue has been patched in version 0.6.0 of the permissions backend. A workaround includes having administrators of the permission policies ensure that they are crafted in such a way that conditional decisions do not contain any sensitive information.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	GitHub_M

Weaknesses

CWE-213 Exposure of Sensitive Information Due to Incompatible Policies

Affected Products

Product	Versions
backstagebackstage	< 0.6.0Affected

References

https://github.com/backstage/backstage/security/advisories/GHSA-f8j4-p5cr-p777

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.