CVE-2026-106489

MEDIUM 6.5

Backstage: Improper authorization enforcement for TechDocs static content

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper authorization enforcement for techdocs static content. An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider (S3, GCS, etc.) and the permission framework enabled. Instances that do not use the permission framework are unaffected, since TechDocs content is visible to all authenticated users by design. This issue is fixed in version 2.2.4.

CWE	CWE-22 CWE-862
Vendor	backstage
Product	backstage
Published	Oct 6, 2026

Stay Ahead of the Next One

Get instant alerts for backstage backstage

Be the first to know when new medium vulnerabilities affecting backstage backstage are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

backstage / backstage

< 1.54.6

@backstage / plugin-techdocs-backend

< 2.2.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/backstage/backstage/security/advisories/GHSA-rg9r-hr7g-5gc2 github.com: https://github.com/backstage/backstage/commit/bf6bbf7326ada7d96d7b2c4ebc4a71546106f311 github.com: https://github.com/backstage/backstage/releases/tag/v1.54.6