All vulnerabilities
CVE-2026-106489GHSA-rg9r-hr7g-5gc2

@backstage/plugin-techdocs-backend: Backstage: Improper authorization enforcement for TechDocs static content

backstage @backstage/plugin-techdocs-backendnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.2.4Fixed versionGitHub
Published6 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

  • 2.2.4@backstage/plugin-techdocs-backend, npmGitHubnpm install @backstage/plugin-techdocs-backend@2.2.4

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider (S3, GCS, etc.) and the permission framework enabled. Instances that do not use the permission framework are unaffected, since TechDocs content is visible to all authenticated users by design.

Patches

Patched in @backstage/plugin-techdocs-backend version 2.2.4

Workarounds

  • None other than upgrading. Deployments that serve TechDocs from local storage are not affected.

Text from GitHub Advisory Database

Affected versions 4

  • @backstage/plugin-techdocs-backend, npm< 2.2.4GitHub
  • backstageaffected: < 1.54.6CVE List
  • plugin-techdocs-backendaffected: < 2.2.4CVE List
  • @backstage/plugin-techdocs-backend, npmfrom first release, fixed in 2.2.4OSV

References 5