Impact
An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider (S3, GCS, etc.) and the permission framework enabled. Instances that do not use the permission framework are unaffected, since TechDocs content is visible to all authenticated users by design.
Patches
Patched in @backstage/plugin-techdocs-backend version 2.2.4
Workarounds
- None other than upgrading. Deployments that serve TechDocs from local storage are not affected.
Impact
When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure.
Patches
Patched in @backstage/plugin-techdocs-backend version 2.2.4
Workarounds
- Restrict access to the TechDocs backend to users who are permitted to view all stored documentation until an upgrade can be applied. - Keep the default backend authentication policy enabled.