Backstage, an open‑source developer portal framework, has a flaw in its Bitbucket Server catalog backend module that allows inconsistent repository filtering when processing event‑driven updates. The module may accept location data from repositories that are otherwise excluded by the provider’s configured project, repository, or archived‑repository filters. This means that a repository that an administrator intends to ignore can still be added to the catalog if its events reach the system.

The vulnerability affects the @backstage/plugin-catalog-backend-module-bitbucket-server package version range 0.4.0 through 0.5.15. Backstage installations that use event‑driven catalog updates and rely on those filtered‑out repositories may ingest unintended catalog locations until the fix is applied. The issue was closed in the 0.5.15 release; associated Backstage core updates conclude with version 1.55.0. The fix prevents the module from adding catalog locations that contravene the configured filters.

The CVSS score for this issue is 6.5, indicating a medium‑impact vulnerability. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. An attacker would need an authenticated Bitbucket Server user account with push rights to a repository that falls under the catalog provider’s filtering rules but remains readable by Backstage. From that position the attacker can trigger a legitimate repository event that results in an unauthorized catalog entry. The lack of a public exploit does not negate the need for remediation, as the vulnerability could be abused to alter catalog exposure or data integrity.