Backstage Plugin Techdocs Backend vulnerabilities

2 vulnerabilities

Known vulnerabilities in Backstage Plugin Techdocs Backend, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.5CVE-2026-106489backstagebackstage+2
EPSS score
0.29%
Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper authorization enforcement for techdocs static content. An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider (S3, GCS, etc.) and the permission framework enabled. Instances that do not use the permission framework are unaffected, since TechDocs content is visible to all authenticated users by design. This issue is fixed in version 2.2.4.6.5CVE-2026-106490backstagebackstage+2
EPSS score
0.36%
Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper input validation in techdocs static content requests. When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. This issue is fixed in version 2.2.4.