01 Record

CVE-2026-73666

OpenChoreo: Unauthenticated Backstage developer-portal API exposes OpenChoreo catalog data, scaffolder logs, and allows unauthenticated catalog write/delete

HighPUBLISHEDCNA: GitHub_M

Base score8.2 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

View raw JSON CVE Program record

02 Description

OpenChoreo: Unauthenticated Backstage developer-portal API exposes OpenChoreo catalog data, scaffolder logs, and allows unauthenticated catalog write/delete

03 Metadata

Published: 2026-08-13 21:40Z21 HR AGO
Last updated: 2026-08-14 18:06Z35 MIN AGO
Reserved: 2026-08-13
Assigning CNA: GitHub_M
Record state: PUBLISHED
Severity: High (CVSS 8.2)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weaknesses: CWE-306
SSVC decision: ExploitationnoneAutomatableyesTechnical Impactpartial
Data version: 5.2
Document digest: ad4bf0bf151090a3f024ad1dcf028093f2e27150c0c96d4983982b6c4cf6100d

04 Affected products

VendorProductVersionsPlatforms

openchoreobackstage-plugins< 1.0.4, >= 1.1.0, < 1.1.4, >= 1.2.0-rc.1, < 1.2.1—

05 References

github.comhttps://github.com/openchoreo/openchoreo/security/advisories/GHSA-v7qx-mqhq-grvhx_refsource_CONFIRM
github.comhttps://github.com/openchoreo/backstage-plugins/pull/709x_refsource_MISC
github.comhttps://github.com/openchoreo/backstage-plugins/pull/712x_refsource_MISC
github.comhttps://github.com/openchoreo/backstage-plugins/pull/713x_refsource_MISC
github.comhttps://github.com/openchoreo/backstage-plugins/pull/716x_refsource_MISC
github.comhttps://github.com/openchoreo/backstage-plugins/commit/114a215689924b917da5fd28c56e679aaccaef07x_refsource_MISC
github.comhttps://github.com/openchoreo/backstage-plugins/commit/dfa3fc8bd1ffef1346442c891e3e3dd54bc26501x_refsource_MISC
github.comhttps://github.com/openchoreo/backstage-plugins/commit/f6df89c15834506902b2f706a9e8fbe1f6ef1474x_refsource_MISC
github.comhttps://github.com/openchoreo/backstage-plugins/commit/fdaceeb737938e830c48a150d5bec24f5f487e52x_refsource_MISC
github.comhttps://github.com/openchoreo/backstage-plugins/releases/tag/v1.0.4x_refsource_MISC
github.comhttps://github.com/openchoreo/backstage-plugins/releases/tag/v1.1.4x_refsource_MISC
github.comhttps://github.com/openchoreo/backstage-plugins/releases/tag/v1.2.1x_refsource_MISC