Threats affecting pkg:github/openchoreo/backstage-plugins

CVE-2026-73666 is a high-severity vulnerability in OpenChoreo backstage-plugins where certain versions prior to 1.0.4, 1.1.4, and 1.2.1 have authentication disabled by default. This misconfiguration exposes API endpoints under /api/* without requiring authentication, allowing unauthenticated users to read catalog data, view scaffolder logs, and create or delete catalog locations. The issue is fixed in versions 1.0.4, 1.1.4, and 1.2.1.