GHSA-7mfx-xg57-53c9

Backstage: Improper input validation in TechDocs static content requests

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-106490

Packages

Ecosystem	Package	Affected	Fixed in
npm	@backstage/plugin-techdocs-backend	< 2.2.4	2.2.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. ### Patches Patched in `@backstage/plugin-techdocs-backend` version `2.2.4` ### Workarounds - Restrict access to the TechDocs backend to users who are permitted to view all stored documentation until an upgrade can be applied. - Keep the default backend authentication policy enabled.

References

External links from the advisory. They lead to third-party sites.

https://github.com/backstage/backstage/security/advisories/GHSA-7mfx-xg57-53c9 web
https://nvd.nist.gov/vuln/detail/CVE-2026-106490 advisory
https://github.com/backstage/backstage/commit/40ecc4c2e88b0218125b0a3405d1f6315b321974 web
https://github.com/backstage/backstage package
https://github.com/backstage/backstage/releases/tag/v1.54.6 web