CVE-2026-106489

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description

Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper authorization enforcement for techdocs static content. An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider (S3, GCS, etc.) and the permission framework enabled. Instances that do not use the permission framework are unaffected, since TechDocs content is visible to all authenticated users by design. This issue is fixed in version 2.2.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106489

EUVD

EUVD-2026-94008

Affected Vendors & Products

Vendor	Product	Version / Range
backstage	backstage	< 1.54.6
@backstage	plugin-techdocs-backend	< 2.2.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects the @backstage/plugin-techdocs-backend package in Backstage versions prior to 2.2.4. It involves improper authorization enforcement for techdocs static content. An authenticated user with access to one TechDocs site could craft a URL to read documentation belonging to a different entity. This only impacts deployments using the external TechDocs builder with external storage like S3 or GCS and the permission framework enabled.

Detection Guidance

Detection requires checking if your Backstage deployment uses the external TechDocs builder with an external storage provider and the permission framework enabled. Review configuration files for @backstage/plugin-techdocs-backend and verify the version is below 2.2.4. Check access logs for unusual URL patterns accessing TechDocs content across different entities.

Impact Analysis

If you use Backstage with the external TechDocs builder, external storage, and permission framework enabled, an attacker could access sensitive documentation from other entities. This could lead to unauthorized data exposure or information leaks within your organization.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) or HIPAA (health information privacy) if exposed documentation contains regulated data. Compliance may be impacted due to unauthorized data disclosure.

Mitigation Strategies

Upgrade @backstage/plugin-techdocs-backend to version 2.2.4 or later immediately. If upgrading is not possible, disable the external TechDocs builder or the permission framework as a temporary workaround. Review and restrict access to TechDocs storage buckets to prevent unauthorized access.

Hi! I’m here to help you understand CVE-2026-106489. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70