The vulnerability is an improper input validation in TechDocs static content requests within the Backstage plugin techdocs backend. An authenticated user can abuse the Azure Blob Storage provider to read restricted TechDocs content when entity‑level permissions are enforced. This flaw allows the unauthorized disclosure of confidential documentation, violating confidentiality. The flaw is a classic path traversal or directory traversal weakness, classified as CWE‑22 and CWE‑23.

Affected components include the @backstage/plugin‑techdocs‑backend package and the backstage framework. Versions prior to 2.2.4 are vulnerable. Deployments that have disabled the default backend authentication policy may expose a larger surface area, potentially allowing any authenticated user to access protected documentation.

The CVSS score of 6.5 indicates a moderate severity. EPSS is currently not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an authenticated user within Backstage. An attacker who can authenticate can request static content that bypasses the intended entity‑level permissions, leading to confidential data leakage. The vulnerability is thus exploitable under normal operation for users with access credentials.