Plugin Catalog Backend Module Bitbucket Server
Monthly
Inconsistent repository filtering in Backstage's Bitbucket Server catalog backend module allows an authenticated Bitbucket Server user to inject catalog locations for repositories that the provider's configured filters are supposed to exclude. Only deployments of @backstage/plugin-catalog-backend-module-bitbucket-server (0.4.0 up to but not including 0.5.15) that use event-driven catalog updates AND configure projectKey, repoSlug, or skipArchivedRepos filters are affected; the attacker must have push access to a filtered-out repository that the Backstage integration credentials can still read. Impact is limited to unauthorized additions to the software catalog (integrity, not confidentiality or availability), no public exploit code has been identified at time of analysis, and exploitation requires valid Bitbucket Server authentication (PR:L) - so this is a genuine but moderate-priority authorization flaw rather than an emergency.
Inconsistent repository filtering in Backstage's Bitbucket Server catalog backend module allows an authenticated Bitbucket Server user to inject catalog locations for repositories that the provider's configured filters are supposed to exclude. Only deployments of @backstage/plugin-catalog-backend-module-bitbucket-server (0.4.0 up to but not including 0.5.15) that use event-driven catalog updates AND configure projectKey, repoSlug, or skipArchivedRepos filters are affected; the attacker must have push access to a filtered-out repository that the Backstage integration credentials can still read. Impact is limited to unauthorized additions to the software catalog (integrity, not confidentiality or availability), no public exploit code has been identified at time of analysis, and exploitation requires valid Bitbucket Server authentication (PR:L) - so this is a genuine but moderate-priority authorization flaw rather than an emergency.