AIKIDO-2025-10259
@backstage/plugin-permission-backend is vulnerable to Exposure of Sensitive Information Due to Incompatible Policies
49
Medium Risk
This Affects:
@backstage/plugin-permission-backendTL;DR
Affected versions of the @backstage/plugin-permission-backend library are vulnerable to information exposure due to insufficient protection of conditional decision data stored in policies. An unauthorized user can infer or extract sensitive details about conditional logic or access decisions they should not be permitted to view.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@backstage/plugin-permission-backend is vulnerable to Exposure of Sensitive Information Due to Incompatible Policies in versions 0.1.0 - 0.5.55.
How to fix this
Upgrade the @backstage/plugin-permission-backend library to the patch version.
Links
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant