fix(deps): update dependency @backstage/plugin-permission-backend to ^0.6.0 [security]

[backstage-goalie[bot]]

This PR contains the following updates:

Package	Type	Update	Change
@backstage/plugin-permission-backend (source)	dependencies	minor	^0.5.53 -> ^0.6.0
@backstage/plugin-permission-backend (source)	dependencies	minor	^0.5.52 -> ^0.6.0
@backstage/plugin-permission-backend (source)	dependencies	minor	^0.5.55 -> ^0.6.0
@backstage/plugin-permission-backend (source)	dependencies	minor	^0.5.53 -> ^0.6.0

---

Permission policy information leakage in Backstage permission system

CVE-2025-32791 / GHSA-f8j4-p5cr-p777

More information

Details

Impact

A vulnerability in the Backstage permission plugin backend allows callers to extract some information about the conditional decisions returned by the permission policy installed in the permission backend. If the permission system is not in use or if the installed permission policy does not use conditional decisions, there is no impact.

Patches

This issue has been resolved in version 0.6.0 of the permissions backend.

Workarounds

Administrators of the permission policies can ensure that they are crafted in such a way that conditional decisions do not contain any sensitive information.

References

If you have any questions or comments about this advisory:

Open an issue in the Backstage repository Visit our Discord, linked to in Backstage README

Severity

• CVSS Score: 4.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/backstage/backstage/security/advisories/GHSA-f8j4-p5cr-p777
• https://nvd.nist.gov/vuln/detail/CVE-2025-32791
• https://github.com/backstage/backstage

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

backstage/backstage (@​backstage/plugin-permission-backend)

v0.6.0

Compare Source

Minor Changes

• 78eaa50: Improved validation for the /authorize endpoint when a resourceRef is provided alongside a basic permission. Additionally, introduced a clearer error message for cases where users attempt to directly evaluate conditional permissions.

Patch Changes

• Updated dependencies
  • @​backstage/backend-plugin-api@​1.3.0
  • @​backstage/plugin-auth-node@​0.6.2
  • @​backstage/plugin-permission-node@​0.9.1
  • @​backstage/config@​1.3.2
  • @​backstage/errors@​1.2.7
  • @​backstage/plugin-permission-common@​0.8.4

v0.5.55

Compare Source

Patch Changes

• Updated dependencies
  • @​backstage/plugin-permission-node@​0.9.0
  • @​backstage/plugin-auth-node@​0.6.1
  • @​backstage/backend-plugin-api@​1.2.1
  • @​backstage/config@​1.3.2
  • @​backstage/errors@​1.2.7
  • @​backstage/plugin-permission-common@​0.8.4

v0.5.54

Compare Source

Patch Changes

• Updated dependencies
  • @​backstage/plugin-permission-node@​0.8.8
  • @​backstage/backend-plugin-api@​1.2.0
  • @​backstage/plugin-auth-node@​0.6.0
  • @​backstage/config@​1.3.2
  • @​backstage/errors@​1.2.7
  • @​backstage/plugin-permission-common@​0.8.4

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• [ ] If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[backstage-goalie[bot]]

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
backend	workspaces/mta/packages/backend	none	v0.0.1

[riginoommen]

@yashoswalyo and @deshmukhmayur can you please help here.

[awanlin]

Hi @ibolton336, any chance you can share the status of the mta workspace? It hasn't been updated in 5 months from the looks of it.