cveboard RSS feed

CVE-2026-106458

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2026
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates

Backstage is an open framework for building developer portals. From 0.4.0 until 0.5.15, the @backstage/plugin-catalog-backend-module-bitbucket-server package is affected by inconsistent repository filtering in bitbucket server catalog event updates. Deployments using event-driven updates in the Bitbucket Server catalog provider may ingest catalog locations from repositories that are excluded by the provider's configured project, repository, or archived-repository filters. An authenticated Bitbucket Server user who can push to a filtered-out repository that remains readable by the configured Backstage integration can trigger a legitimate repository event. The affected event path may then add a Location for that repository even though scheduled discovery excludes it. This issue is fixed in version 0.5.15.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

backstage

Vendor
backstage
Product
backstage
Platforms
Unknown
Default status
Unknown
backstage · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
>= 1.38.0, < 1.55.0affectedUnavailableUnavailableUnavailableNone listed

plugin-catalog-backend-module-bitbucket-server

Vendor
@backstage
Product
plugin-catalog-backend-module-bitbucket-server
Platforms
Unknown
Default status
Unknown
plugin-catalog-backend-module-bitbucket-server · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
>= 0.4.0, < 0.5.15affectedUnavailableUnavailableUnavailableNone listed