{"id":"EUVD-2026-93992","enisaUuid":"09aa0fef-e3f2-3bca-8f0d-722232e7e033","description":"Backstage is an open framework for building developer portals. From 0.4.0 until 0.5.15, the @backstage/plugin-catalog-backend-module-bitbucket-server package is affected by inconsistent repository filtering in bitbucket server catalog event updates. Deployments using event-driven updates in the Bitbucket Server catalog provider may ingest catalog locations from repositories that are excluded by the provider\u0027s configured project, repository, or archived-repository filters. An authenticated Bitbucket Server user who can push to a filtered-out repository that remains readable by the configured Backstage integration can trigger a legitimate repository event. The affected event path may then add a Location for that repository even though scheduled discovery excludes it. This issue is fixed in version 0.5.15.","datePublished":"Oct 6, 2026, 8:16:12 PM","dateUpdated":"Oct 7, 2026, 5:07:16 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","references":"https://github.com/backstage/backstage/security/advisories/GHSA-c36c-cf6r-ghgj\nhttps://github.com/backstage/backstage/commit/989db63b6f87c8fc04d440f296ad89e10c79b363\nhttps://github.com/backstage/backstage/releases/tag/v1.55.0\n","aliases":"CVE-2026-106458\nGHSA-c36c-cf6r-ghgj\n","assigner":"GitHub_M","epss":0.27,"enisaIdProduct":[{"id":"0ba70076-eb23-399d-a2e3-3feda41a7c23","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"1.38.0, \u003c 1.55.0"},{"id":"fbde399a-9ebc-3d3e-b6c1-8c5814733ab9","product":{"name":"plugin-catalog-backend-module-bitbucket-server","vendor":{"name":"@backstage"}},"product_version":"0.4.0, \u003c 0.5.15"}],"enisaIdVendor":[{"id":"16f5bc28-94a4-3d66-a221-dddb7cb18667","vendor":{"name":"@backstage"}},{"id":"fb783c0f-f8bc-3dfa-82e6-e399711f93d7","vendor":{"name":"backstage"}}],"enisaIdVulnerability":[{"id":"48ae7784-b815-3f34-9ba5-4456efd225c6","vulnerability":{"id":"GHSA-c36c-cf6r-ghgj","description":" Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates","datePublished":"Oct 7, 2026, 8:25:08 PM","dateUpdated":"Oct 7, 2026, 8:25:08 PM","baseScore":0.0,"references":"https://github.com/backstage/backstage/security/advisories/GHSA-c36c-cf6r-ghgj\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-106458\nhttps://github.com/backstage/backstage/commit/989db63b6f87c8fc04d440f296ad89e10c79b363\nhttps://github.com/backstage/backstage\nhttps://github.com/backstage/backstage/releases/tag/v1.55.0\n","enisa_id":"EUVD-2026-93992\n","aliases":"CVE-2026-106458\nGHSA-c36c-cf6r-ghgj\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"9c10a5b5-c73f-3d03-ac45-0f0fc1143c94","vulnerability":{"id":"CVE-2026-106458","description":"Backstage is an open framework for building developer portals. From 0.4.0 until 0.5.15, the @backstage/plugin-catalog-backend-module-bitbucket-server package is affected by inconsistent repository filtering in bitbucket server catalog event updates. Deployments using event-driven updates in the Bitbucket Server catalog provider may ingest catalog locations from repositories that are excluded by the provider\u0027s configured project, repository, or archived-repository filters. An authenticated Bitbucket Server user who can push to a filtered-out repository that remains readable by the configured Backstage integration can trigger a legitimate repository event. The affected event path may then add a Location for that repository even though scheduled discovery excludes it. This issue is fixed in version 0.5.15.","datePublished":"Oct 6, 2026, 8:16:12 PM","dateUpdated":"Oct 7, 2026, 5:07:16 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","references":"https://github.com/backstage/backstage/security/advisories/GHSA-c36c-cf6r-ghgj\nhttps://github.com/backstage/backstage/commit/989db63b6f87c8fc04d440f296ad89e10c79b363\nhttps://github.com/backstage/backstage/releases/tag/v1.55.0\n","enisa_id":"EUVD-2026-93992\n","assigner":"GitHub_M","epss":0.27,"dataProcessed":"Oct 29, 2026, 7:16:09 AM","vulnerabilityProduct":[{"id":"9554116d-48a8-3028-8b91-4b8192ce37f4","product":{"name":"plugin-catalog-backend-module-bitbucket-server","vendor":{"name":"@backstage"}},"product_version":"0.4.0, \u003c 0.5.15"},{"id":"c1fde357-bfff-3628-aab5-97b2aeb305b2","product":{"name":"backstage","vendor":{"name":"backstage"}},"product_version":"1.38.0, \u003c 1.55.0"}],"vulnerabilityVendor":[{"id":"0ff8a32d-8d0a-3d45-bc37-6175f19e1cca","vendor":{"name":"backstage"}},{"id":"3374e813-8ebb-34c2-8f7c-79387e2224bc","vendor":{"name":"@backstage"}}]}}],"enisaIdAdvisory":[]}