Executive brief
Backstage is an open-source platform for building developer portals. A flaw in its permission system allows authenticated users to extract sensitive information from permission policy decisions. The risk is limited to deployments that actively use conditional permission policies, but could expose confidential details about access control rules.
Technical details
The vulnerability is an information disclosure (CWE-213) in the Backstage permission plugin backend. Authenticated callers can extract information about conditional decisions returned by permission policies, potentially revealing sensitive policy logic. The attack requires network access and valid credentials (PR:L), and does not require user interaction. No integrity or availability impact is present—only confidential disclosure. Patch is available in version 0.6.0 of @backstage/plugin-permission-backend. Workaround: administrators can craft permission policies to avoid embedding sensitive data in conditional decisions.
Affected products
- Backstage permission-backend plugin < 0.6.0
Timeline
- 2025-04-16: disclosed
- 2025-04-16: patched: Version 0.6.0 available