Em resumo
- CVE-2026-106490 é uma vulnerabilidade MÉDIO (CVSS 6.5) que afeta backstage (linuxfoundation), backstage/plugin-techdocs-backend (linuxfoundation), @backstage/plugin-techdocs-backend.
- Chance de exploração nos próximos 30 dias (EPSS): 0.37%, maior que 30.9% das vulnerabilidades.
- Correção: atualize para 1.54.6, 2.2.4 ou posterior.
Description
Impact
When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure.
Patches
Patched in @backstage/plugin-techdocs-backend version 2.2.4
Workarounds
- Restrict access to the TechDocs backend to users who are permitted to view all stored documentation until an upgrade can be applied.
- Keep the default backend authentication policy enabled.
NVD description
Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper input validation in techdocs static content requests. When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. This issue is fixed in version 2.2.4.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free