PT-2025-16909 · Unknown · Backstage Permission Plugin Backend

Rugvip · Published 2025-04-16 · Updated 2026-03-12 · CVE-2025-32791

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Backstage permission plugin backend versions prior to 0.6.0

Description A vulnerability in the Backstage permission plugin backend allows callers to extract some information about the conditional decisions returned by the permission policy installed in the permission backend. If the permission system is not in use or if the installed permission policy does not use conditional decisions, there is no impact.

Recommendations For versions prior to 0.6.0, update to version 0.6.0 to resolve the issue. As a temporary workaround, administrators of the permission policies should ensure that they are crafted in such a way that conditional decisions do not contain any sensitive information.

Exploit

Fix

Weakness Enumeration

CWE-213

Related Identifiers

CVE-2025-32791

GHSA-F8J4-P5CR-P777

Affected Products

Backstage Permission Plugin Backend

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32791.json · Exploit
• https://osv.dev/vulnerability/GHSA-f8j4-p5cr-p777 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32791 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32791 · Vendor Advisory
• https://github.com/backstage/backstage · Note
• https://github.com/backstage/backstage/security/advisories/GHSA-f8j4-p5cr-p777 · Note
• https://t.me/cvetracker/21813 · Telegram Post
• https://twitter.com/dailycve/status/2032237826524254212 · Twitter Post
• https://twitter.com/CVEnew/status/1912722263981309972 · Twitter Post