OpenChoreo backstage-plugins versions before 1.0.4, 1.1.4, and 1.2.1 have hardcoded configuration settings that disable default authentication policies (backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment set to true). This results in unauthenticated access to /api/* endpoints, enabling unauthorized catalog reads, scaffolder log reads, and catalog location modifications. The vulnerability corresponds to CWE-306 (Missing Authentication for Critical Function). It is resolved by updating to versions 1.0.4, 1.1.4, or 1.2.1 where the default authentication policies are properly enforced.

The vulnerability allows unauthenticated attackers to access sensitive backend API endpoints, leading to unauthorized disclosure of catalog information and scaffolder logs, as well as unauthorized creation or deletion of catalog locations. This can compromise the integrity and confidentiality of the OpenChoreo platform's data and operations. The CVSS 3.1 base score is 8.2, reflecting high impact on confidentiality with low impact on integrity and no impact on availability.

Upgrade OpenChoreo backstage-plugins to version 1.0.4, 1.1.4, or 1.2.1 or later, where the authentication bypass issue is fixed. There is no indication of an official patch advisory, but the fixed versions explicitly address the problem by enabling proper authentication. Until upgraded, restrict access to the /api/* endpoints to trusted users or networks as a temporary measure.