backstage @backstage/plugin-permission-backend vulnerabilities

Latest backstage @backstage/plugin-permission-backend CVEs

Newest publication first

1. CVE-2025-32791 Permission policy information leakage in Backstage permission system

   Published 2025-04-16

   Medium·CVSS 4.3 EPSS 0.30%

   The Backstage Scaffolder plugin houses types and utilities for building scaffolder-related modules. A vulnerability in the Backstage permission plugin backend allows callers to extract some information about the conditional decisions returned by the permission policy installed in...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.