The vulnerability exists in the OpenChoreo Backstage backend because two authentication flags are hardcoded to true before version 1.0.4. These flags turn off the default authentication policy and allow guest access outside development, making the entire /api/* interface reachable without any credentials. An attacker with network access can read catalog data, view scaffolder logs, and create or delete catalog locations, leading to unauthorized disclosure and modification of critical deployment information.

The affected product is the OpenChoreo Backstage backend provided by openchoreo:backstage-plugins. Versions prior to 1.0.4, 1.1.4, and 1.2.1 are vulnerable, while releases from 1.0.4 onward contain the fix. The platform is used as a developer interface for Kubernetes environments.

With a CVSS score of 8.2, the issue is classified as high severity. There is no EPSS data available, so the precise exploitation probability remains unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers can leverage simple unauthenticated HTTP requests to the exposed /api/* endpoints, bypassing all authorization controls and performing read or write operations. The exploit requires only connectivity to the backend service, making it straightforward for anyone with network visibility.