6.5
Moyenne
CVE-2026-106489 Backstage is an open framework for building developer portals
Description
Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper authorization enforcement for techdocs static content. An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider (S3, GCS, etc.) and the permission framework enabled. Instances that do not use the permission framework are unaffected, since TechDocs content is visible to all authenticated users by design. This issue is fixed in version 2.2.4.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| backstage 1.54 | premières → < 1.54.6 | 1.54.6 |
| plugin-techdocs-backend 2.2 | premières → < 2.2.4 | 2.2.4 |
Autres CVE de backstage
Les 69 CVE de backstage →
CVE-2026-115923
Backstage is an open framework for building developer portals
6.5
Moyenne
CVE-2026-106495
Backstage is an open framework for building developer portals
4.3
Moyenne
CVE-2026-106557
Backstage is an open framework for building developer portals
7.7
Élevée
CVE-2026-106563
Backstage is an open framework for building developer portals
5.3
Moyenne