CVE-2025-32791

Summary

CVE-2025-32791 is a vulnerability affecting the Backstage Scaffolder plugin's permission plugin backend. This issue enables callers to extract sensitive information about conditional decisions in the permission policy installed in the backend. However, if the permission system is not in use or the installed policy does not utilize conditional decisions, there is no impact. Version 0.6.0 of the permissions backend has been released as a patch, and a workaround involves ensuring that administrators of permission policies design them without including sensitive information in conditional decisions.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.