CVE-2026-73666

Name of the Vulnerable Software and Affected Versions OpenChoreo versions prior to 1.0.4 OpenChoreo versions prior to 1.1.4 OpenChoreo versions prior to 1.2.1

Description The OpenChoreo Backstage backend hardcoded the variables backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true. This configuration exposes the /api/* endpoint without authentication, enabling unauthenticated users to read catalog data, access scaffolder logs, and create or delete catalog locations.

Recommendations Update to version 1.0.4. Update to version 1.1.4. Update to version 1.2.1.