fix(deps): update dependency @backstage/plugin-permission-backend to ^0.6.0

[mend-on-mend]

This PR contains the following updates:

Package	Change	Age	Confidence
@backstage/plugin-permission-backend (source)	^0.5.55 -> ^0.6.0

---

Permission policy information leakage in Backstage permission system

CVE-2025-32791 / GHSA-f8j4-p5cr-p777

More information

Details

Impact

A vulnerability in the Backstage permission plugin backend allows callers to extract some information about the conditional decisions returned by the permission policy installed in the permission backend. If the permission system is not in use or if the installed permission policy does not use conditional decisions, there is no impact.

Patches

This issue has been resolved in version 0.6.0 of the permissions backend.

Workarounds

Administrators of the permission policies can ensure that they are crafted in such a way that conditional decisions do not contain any sensitive information.

References

If you have any questions or comments about this advisory:

Open an issue in the Backstage repository
Visit our Discord, linked to in Backstage README

Severity

• CVSS Score: 4.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/backstage/backstage/security/advisories/GHSA-f8j4-p5cr-p777
• https://nvd.nist.gov/vuln/detail/CVE-2025-32791
• https://github.com/backstage/backstage

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

backstage/backstage (@​backstage/plugin-permission-backend)

v0.6.0

Compare Source

Minor Changes

• 78eaa50: Improved validation for the /authorize endpoint when a resourceRef is provided alongside a basic permission. Additionally, introduced a clearer error message for cases where users attempt to directly evaluate conditional permissions.

Patch Changes

• Updated dependencies
  • @​backstage/backend-plugin-api@​1.3.0
  • @​backstage/plugin-auth-node@​0.6.2
  • @​backstage/plugin-permission-node@​0.9.1
  • @​backstage/config@​1.3.2
  • @​backstage/errors@​1.2.7
  • @​backstage/plugin-permission-common@​0.8.4

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution!