Plugin Search Backend
Monthly
Permission-filtered search in Backstage deployments that use an Elasticsearch or OpenSearch backend can return documents that a DENY policy should have withheld, because an empty list of permitted document types causes the engine to issue an unfiltered query across all indices instead of returning zero results. Only authenticated Backstage users (CVSS PR:L) are positioned to trigger this, and only when permission.enabled is set to true, the search backend is Elasticsearch/OpenSearch rather than the default in-memory engine, and the user is actually governed by a DENY policy for one or more search document types; the impact is limited to confidentiality (C:L) with no integrity or availability effect. The vendor has released fixes in @backstage/plugin-search-backend 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch 1.8.7 (Backstage release v1.54.1), and there is no public exploit identified at time of analysis. Consistent with our independent assessment, this is a genuine but low-urgency information-disclosure issue rather than a high-priority emergency.
Permission-filtered search in Backstage deployments that use an Elasticsearch or OpenSearch backend can return documents that a DENY policy should have withheld, because an empty list of permitted document types causes the engine to issue an unfiltered query across all indices instead of returning zero results. Only authenticated Backstage users (CVSS PR:L) are positioned to trigger this, and only when permission.enabled is set to true, the search backend is Elasticsearch/OpenSearch rather than the default in-memory engine, and the user is actually governed by a DENY policy for one or more search document types; the impact is limited to confidentiality (C:L) with no integrity or availability effect. The vendor has released fixes in @backstage/plugin-search-backend 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch 1.8.7 (Backstage release v1.54.1), and there is no public exploit identified at time of analysis. Consistent with our independent assessment, this is a genuine but low-urgency information-disclosure issue rather than a high-priority emergency.