Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider (S3, GCS, etc.) and the permission framework enabled. Instances that do not use the permission framework are unaffected, since TechDocs content is visible to all authenticated users by design. Patches Patched in @backstage/plugin-techdocs-backend version 2.2.4 Workarounds - None other than upgrading. Deployments that serve TechDocs from local storage are not affected.
Recommended action: Upgrade to 2.2.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. Patches Patched in @backstage/plugin-techdocs-backend version 2.2.4 Workarounds - Restrict access to the TechDocs backend to users who are permitted to view all stored documentation until an upgrade can be applied. - Keep the default backend authentication policy enabled.
Recommended action: Upgrade to 2.2.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An attacker with control of the contents of the TechDocs storage buckets is able to inject executable scripts in the TechDocs content that will be executed in the victim's browser when browsing documentation or navigating to an attacker provided link. Patches This has been fixed in the 1.10.13 release of the @backstage/plugin-techdocs-backend package. References If you have any questions or comments about this advisory: Open an issue in the Backstage repository Visit our Discord, linked to in Backstage README
Recommended action: Upgrade to 1.10.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessible, as well as bypass permission checks in Backstage. Patches This has been fixed in the 1.10.13 release of the @backstage/plugin-techdocs-backend package. References If you have any questions or comments about this advisory: Open an issue in the Backstage repository Visit our Discord, linked to in Backstage README
Recommended action: Upgrade to 1.10.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.