CVE-2025-32791

The Backstage Scaffolder plugin houses types and utilities for building scaffolder-related modules. A vulnerability in the Backstage permission plugin backend allows callers to extract some information about the conditional decisions returned by the permission policy installed in the permission backend. If the permission system is not in use or if the installed permission policy does not use conditional decisions, there is no impact. This issue has been patched in version 0.6.0 of the permissions backend. A workaround includes having administrators of the permission policies ensure that they are crafted in such a way that conditional decisions do not contain any sensitive information.

• CWE-213

• https://github.com/backstage/backstage/security/advisories/GHSA-f8j4-p5cr-p777

Published

Apr 16, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-32786The GLPI Inventory Plugin handles network discovery, invento…7.5
• CVE-2025-32787SoftEtherVPN is a an open-source cross-platform multi-protoc…3.1
• CVE-2025-32788OctoPrint provides a web interface for controlling consumer …4.3
• CVE-2025-32789EspoCRM is an Open Source Customer Relationship Management s…3.7
• CVE-2025-3279An issue has been discovered in GitLab CE/EE affecting all v…6.5
• CVE-2025-32790Dify is an open-source LLM app development platform. In vers…4.3
• CVE-2025-32792SES safely executes third-party JavaScript 'strict' mode pro…8.7
• CVE-2025-32793Cilium is a networking, observability, and security solution…4
• CVE-2025-32794OpenEMR is a free and open source electronic health records …7.6
• CVE-2025-32795Dify is an open-source LLM app development platform. Prior t…6.5
• CVE-2025-32796Dify is an open-source LLM app development platform. Prior t…6.5
• CVE-2025-32797Conda-build contains commands and tools to build conda packa…7