CVE-2025-32791 - CVE House
Back to Database
Status published Medium CVE-2025-32791

Permission policy information leakage in Backstage permission system

Vulnerability Description

The Backstage Scaffolder plugin houses types and utilities for building scaffolder-related modules. A vulnerability in the Backstage permission plugin backend allows callers to extract some information about the conditional decisions returned by the permission policy installed in the permission backend. If the permission system is not in use or if the installed permission policy does not use conditional decisions, there is no impact. This issue has been patched in version 0.6.0 of the permissions backend. A workaround includes having administrators of the permission policies ensure that they are crafted in such a way that conditional decisions do not contain any sensitive information.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-32791

Credits & Attribution

No credits recorded in the NVD database.

References

More from backstage

View All →
CVE-2025-55285
@backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`
Low 2.6
CVE-2024-53983
Server-side request forgery in Backstage Scaffolder plugin
Medium 5.4
CVE-2024-47762
Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend
Medium 5.8
CVE-2024-46976
Circumvention of cross site scripting Protection in @backstage/plugin-techdocs-backend
Medium 6.5
CVE-2024-45816
Storage bucket Directory Traversal in @backstage/plugin-techdocs-backend
Medium 6.5

Affected Vendor

Affected Software

backstage
Vulnerable Versions:
< 0.6.0

Timeline

Official Publish: April 16th, 2025
Last Modified: April 17th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-213

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.