Backstage’s search backend can return documents that an authenticated user is denied from viewing when permission filtering is enabled. The flaw allows a user who has a deny policy for certain search document types to receive those restricted documents, thereby exposing sensitive information that should not be visible. The impact is a confidentiality breach limited to search results and does not provide code execution or system control.

The vulnerability affects the @backstage/plugin-search-backend package before version 2.1.6 and the @backstage/plugin-search-backend-module-elasticsearch package before version 1.8.7. Deployments that use Backstage with Elasticsearch or OpenSearch as a search backend and have permission enforcement turned on are at risk. Upgrading the affected packages to the patched versions resolves the issue.

The CVSS score is 4.3, indicating moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. An attacker must be an authenticated Backstage user with an existing deny policy for document types, and must have access to a deployment where permission.enabled=true and an Elasticsearch/OpenSearch backend is used. While exploitation does not grant code execution, it can lead to unauthorized disclosure of internal data if the attacker can access or modify search queries.