Backstage EUVD-2026-93992

Exploitation requires a deployment running the Bitbucket Server catalog provider (@backstage/plugin-catalog-backend-module-bitbucket-server, versions 0.4.0 up to but not including 0.5.15) with event-driven catalog updates enabled AND repository filters configured (projectKey, repoSlug, or skipArchivedRepos). The attacker must be an authenticated Bitbucket Server user with push access to a repository that is excluded by those filters but still readable by the configured Backstage integration credentials. LIMITING FACTORS: valid Bitbucket Server authentication is mandatory (PR:L); deployments that do not use event-driven updates, do not configure filters, or do not run this specific provider are not affected; the attacker cannot target repositories they lack push access to or that the Backstage integration cannot read.

This is a genuine but moderate-priority authorization flaw, not a drop-everything emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, 6.5) correctly captures that exploitation is network-reachable and low-complexity but requires an authenticated Bitbucket Server user (PR:L) - so this is NOT exploitable by anonymous attackers. No EPSS score, SSVC decision data, or KEV listing was provided in the input; exploitation status is therefore 'no public exploit identified at time of analysis.' The real-world risk is bounded by the attacker precondition: the actor must already be an authenticated Bitbucket Server user with push access to a repository that is deliberately filtered out of Backstage discovery yet still readable by the Backstage integration credentials - an insider or compromised-developer scenario rather than opportunistic internet-wide attack. One signal to weigh carefully: the CVSS asserts I:H (high integrity impact), but the described effect is limited to adding catalog Location entries for otherwise-excluded repositories, which reads closer to partial integrity impact; the practical downstream impact depends on what the ingested catalog entities can do (e.g., claiming ownership, injecting entity metadata). Verify the concrete blast radius with the vendor advisory GHSA-c36c-cf6r-ghgj. Overall: a real defense-in-depth bypass worth patching on a normal cycle, but low likelihood of mass exploitation.

An authenticated Bitbucket Server user with push rights to a repository that administrators intentionally excluded via Backstage's project/repo/archived filters pushes a commit, generating a legitimate repository push event. Backstage's event-driven catalog update path - which did not apply the same filters as scheduled discovery - ingests a catalog Location from that excluded repository, injecting entities the organization meant to keep out of its software catalog. No public exploit code or proof-of-concept was identified in the provided data; exploitation requires valid Bitbucket Server credentials and does not work against anonymous attackers.