The vulnerability is an improper authorization enforcement that allows an authenticated user to craft a URL and read static documentation belonging to a different entity. This can expose confidential or proprietary technical documentation intended to be restricted to the original entity. The weakness is classified under CWE‑862 for unauthorized access, CWE‑22 for inappropriate path handling, and CWE‑639 for authorization bypass through user-controlled input. The primary impact is data exposure rather than code execution or denial of service.

Affecting @backstage/plugin-techdocs-backend and backstage:backstage versions prior to 2.2.4 when the external TechDocs builder is used with an external storage provider such as S3 or GCS and the permission framework is enabled. Systems that do not enable the permission framework are not vulnerable because all authenticated users already have visibility of TechDocs content by design.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attack requires that the user is authenticated and has at least access to one TechDocs site; the adversary then crafts a URL that references another entity’s documentation. Exploitation can be carried out over the same network where the Backstage instance is accessed, without needing external attack vectors. Because the condition of permission framework enforcement is a prerequisite, the risk is limited to deployments that have that feature enabled.