GHSA-9325-vq29-gp3v Backstage has incorrect authorization in search engine permission filtering

• npm @backstage/plugin-search-backend: < 2.1.6 → fixed in 2.1.6 • npm @backstage/plugin-search-backend-module-elasticsearch: < 1.8.7 → fixed in 1.8.7

Impact An authenticated Backstage user subject to a `DENY` policy for search document types could receive search results they were not authorized to view. This affects deployments with `permission.enabled: true` and an Elasticsearch or OpenSearch search backend. Patches • Upgrade `@backstage/plugin-search-backend` to 2.1.6 • Upgrade `@backstage/plugin-search-backend-module-elasticsearch` to 1.8.7 Workarounds If you are unable to upgrade immediately: • Temporarily modify permission policies to use `CONDITIONAL` decisions with per-result filtering rather than blanket `DENY` for search document types • Restrict Elasticsearch/OpenSearch index access at the cluster level so that the search service account can only reach expected Backstage indices, limiting the blast radius if the authorization bypass is triggered.